Listen to this Post
Introduction:
In the high-stakes world of bug bounty hunting, sophisticated Web Application Firewalls (WAFs) like Cloudflare often force researchers to hit a wall with traditional payload spraying. This article deconstructs a real-world case where a persistent Stored Cross-Site Scripting (XSS) vulnerability was discovered in Shopify’s admin panel not by a new tool, but by a critical shift in perspective: thinking like the system’s architect. We’ll explore how targeting the logical, intended GraphQL API paths for content management led to a high-impact finding, and translate this methodology into actionable techniques for both offensive discovery and defensive hardening.
Learning Objectives:
- Understand how to pivot from front-end fuzzing to backend API analysis when hunting for logic-based vulnerabilities.
- Learn the structure of Shopify’s GraphQL Admin API and how to craft test mutations for stored XSS.
- Develop a security mindset focused on architectural logic and intended data flows to identify gaps in sanitization.
You Should Know:
- The Hunter’s Pivot: From Blocked Scripts to GraphQL Mutations
The initial approach of testing standard comment forms and input fields was systematically blocked by robust WAF rules. The breakthrough came from asking a fundamental question: “Where does the application intend for users to insert rich HTML content securely?” For an e-commerce platform like Shopify, the answer lies in merchant-controlled areas like product descriptions, blog articles, or collection details within the admin panel. The researcher shifted focus to the GraphQL Admin API, Shopify’s primary modern interface for creating and updating content.
Step-by-step guide explaining what this does and how to use it.
Step 1: Access and Understand the API Endpoint. The GraphQL API uses a single endpoint (e.g., /admin/api/{version}/graphql.json). Authentication is performed using access tokens with specific scopes.
Step 2: Identify a Relevant Mutation. Using developer tools or documentation, find mutations responsible for creating or updating content-rich objects. In this case, mutations like `articleCreate` or `productUpdate` were key candidates.
Step 3: Craft a Test Payload. Instead of a classic <script>alert(1)</script>, start with a simple HTML payload to test sanitization. A common test is using an `img` tag with an `onerror` handler: <img src=x onerror=console.log(1)>. This tests if event handlers are filtered.
Step 4: Analyze the Response. Send the mutation. A `200 OK` response with your payload stored unmodified in the JSON response is the first critical indicator. This shows the input was accepted by the backend system before any front-end rendering.
- Bypassing Client-Side Filters: The Power of Event Handlers and Obscure Tags
Modern front-end frameworks and WAFs are excellent at blocking classic `