$37,500 Shopify auth bypass - Hackerone

This time I have for you more than one bug bounty report. It's three reports in total but all of them affect the same functionality and are tightly correlated. They led to the auth bypass and account takeovers on Shopify and exploited email confirmation flow.

Report links:

Hacker:

Reconless channel:

Follow me on twitter:

Timestamps:
00:00 Intro
00:33 verifying someone's email address
01:28 exploiting email confirmation vulnerability
02:06 first fix
03:50 limited impact and third report
05:20 escalating the impact

#auth #bypass #shopify #hackerone #ato #account #takeover

[BugBountyReportsExplained]

Welcome to the comment section!
First, thanks for watching!

Make sure you are subscribed if you liked the video!

Follow me on twitter:

✉️ Sign up for the mailing list ✉️

☕️ Support my channel ☕️

🖥 Get $100 in credits for Digital Ocean 🖥

[CommitSNIPS]

Love this format of content! I can tell you put a lot of effort into this

[firewallguy]

Your videos are simple to understand and awesome.

[rodrigomolinagarrido]

subscribed after just watching two vids, amazing content

[_rudra_raj_]

Please make more such vedios ... It's really helpful ... Thanks

[bughunter]

Nice contents sir! Already subscribed. Hoping that you upload more videos🥳

[rhyswoolcott]

This guy looks like every teenage bully in cartoons

[gustialfian]

This is crazy🔥 i was looking for bug on account 2fa system at shopify but didn't got anything

[tigerarabia]

New sub here, really amazing content. I love your videos❤️

[mohits]

Hi, I have a few questions, I would be grateful if anyone could answer my queries
1) How would the hacker know about the new accounts which have not been confirmed? I am assuming that the confirmation is for new accounts, not for old ones correct me if I am wrong.
2) How did the hacker got to know about the merge accounts path/url?
3) Can't shopify disable/remove the change email id link while confirmating an account?

[_____m________]

hey man! Thanks for this information.. keep it up i'm your new subscriber :)

[LOL-qjkw]

That was really generous of shoppify team to reward bounty While on the other hand there have been many cases from multiple different programs where the vulnerability was patched and hacker wasnt even rewarded once

[carljustinemosquida]

New sub here, please do create more vids like this😎

[meetsodha]

But what we will do if the program says how will you get access to the attackers account for changing email address