GHSA-6j52-38f8-qhxr: Shopify App: Token exchange shop context confusion may allow cross-shop authorization bypass in affected apps
In token-exchange authenticated controllers, shopifyapp exposes shop context through helpers such as currentshopifydomain. Prior to the fix, currentshopifydomain could resolve to the sanitized shop query parameter instead of the shop identity derived from the verified Shopify ID token or active Shopify session.
As a result, a request authenticated for one shop could include a different shop query parameter, causing application code to treat the requested shop as the current shop.
Applications that used currentshopifydomain, or the request shop parameter, for authorization decisions, tenant lookup, stored access-token selection, or shop-scoped data access may have been vulnerable to cross-shop context confusion.
The patched version hardens token-exchange handling so that: - currentshopifydomain resolves to the authenticated shop from the verified token or session. - authenticatedshopifydomain exposes the trusted authenticated shop. - requestedshopifydomain exposes the sanitized requested shop parameter for bootstrap or routing use cases only. - Token-exchange requests are rejected with 401 Unauthorized when the requested shop does not match the authenticated shop.
Impact
In affected applications, an attacker with a valid Shopify session token for one shop could send an authenticated request that also supplied a different shop query parameter. If the application relied on currentshopifydomain or params[:shop] for security-sensitive shop scoping, application code could operate in the context of the requested shop rather than the authenticated shop.
Affected applications are those that:
1. Use shopifyapp token-exchange authentication; 2. Accept authenticated controller requests where a shop query parameter may be present; and 3. Use currentshopifydomain or the request shop parameter for authorization, tenant lookup, stored access-token selection, or shop-scoped resource access.
Depending on the application’s authorization model, this could result in unauthorized access to another shop’s application data or unauthorized shop-scoped actions.
Remediation Upgrade to shopifyapp version 23.0.3
Workarounds Applications that cannot upgrade immediately should apply equivalent validation in token-exchange authenticated controllers:
- Do not use params[:shop] for authorization, tenant lookup, access-token selection, or data scoping. - On vulnerable versions, avoid relying on currentshopifydomain for security-sensitive shop scoping if a shop query parameter may be present. - Use the authenticated shop from the verified ID token or active Shopify session instead, such as currentshopifysession.shop or the verified JWT dest value. - If a sanitized params[:shop] value is present, reject the request with 401 Unauthorized when it does not match the authenticated shop.
Credit
This issue was responsibly reported by Hackerone researcher leqtuer.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
rubygems/shopify_appto a version that resolves this vulnerability.Fixed in 23.0.3 - Upgrade
Upgrade
shopify_appto a version that resolves this vulnerability.Fixed in 23.0.3 - Compensating control
In token-exchange authenticated controllers, use the authenticated shop from the verified ID token or active Shopify session (such as current_shopify_session.shop, verified JWT dest, or authenticated_shopify_domain) for authorization, tenant lookup, stored access-token selection, and shop-scoped access. Do not use params[:shop] or requested_shopify_domain for those security-sensitive decisions; if a sanitized shop parameter is present and does not match the authenticated shop, reject the request with 401 Unauthorized. Use requested_shopify_domain only for bootstrap or routing.
Event History
Frequently Asked Questions
Which applications are realistically exposed to cross-shop access?
Affected applications are those with token-exchange authenticated controllers that used current_shopify_domain or the request shop parameter for authorization, tenant lookup, stored access-token selection, or access to shop-scoped data. The issue requires application code to rely on that untrusted or incorrectly resolved context.
What does an attacker need to exploit this?
An attacker needs a request authenticated for one shop and must supply a different shop value in the query parameter. Exploitation depends on the application using that value, directly or through current_shopify_domain, for a security-sensitive shop-scoping decision.
How can we determine whether our application may be affected?
Review token-exchange authenticated controllers for use of current_shopify_domain or the shop request parameter in authorization checks, tenant resolution, access-token retrieval, or shop-scoped database queries. Test whether an authenticated request for one shop can provide another shop in the shop query parameter and cause the application to operate in that other shop's context.
What behavior does the patched release enforce?
The patch makes current_shopify_domain resolve from the verified token or active session, and provides authenticated_shopify_domain for the trusted authenticated shop. It also reserves requested_shopify_domain for the sanitized requested parameter and rejects token-exchange requests with 401 Unauthorized when the requested and authenticated shops do not match.