Executive brief
Shopify's koa-shopify-auth is a library used by Node.js applications to handle authentication with Shopify's API. A cross-site scripting (XSS) vulnerability in versions 3.1.61–3.1.62 allows attackers to inject malicious JavaScript code via the shop parameter on the authentication endpoint, potentially stealing session tokens or performing unauthorized actions on behalf of authenticated users.
Technical details
A reflected cross-site scripting vulnerability (CWE-79) exists in koa-shopify-auth versions 3.1.61 through 3.1.62 on the /shopify/auth/enable_cookies endpoint. The vulnerability stems from insufficient input validation of the shop parameter, which is reflected into the response without proper encoding. An attacker can craft a malicious URL containing JavaScript payloads in the shop parameter that executes in a victim's browser when clicked. User interaction (clicking a link) is required for exploitation. The vulnerability was fixed in version 3.1.63 via input sanitization changes merged in the upstream Shopify/quilt repository.
Affected products
- Shopify koa-shopify-auth 3.1.61–3.1.62
Timeline
- 2020-07-02: disclosed: NVD publication date
- 2020-05-23: patched: Fix merged in upstream repository
- 2021-05-17: advisory: GHSA advisory published