Shopify API flaw offered access to revenue data of thousands of stores

guest · Apr 18, 2019

Shopify API flaw offered access to revenue data of thousands of stores
April 18, 2019
https://www.zdnet.com/article/shopi...-revenue-traffic-data-of-thousands-of-stores/

A security flaw in a Shopify API endpoint has been discovered by a researcher which can be exploited to leak the revenue and traffic data of thousands of stores.
Application security engineer and bug bounty hunter Ayoub Fathi disclosed his findings in a Medium blog post this week.

Out of 1000 stores, only four -- one of which was closed -- were shown to be vulnerable. However, the researcher dug deeper by using a larger dataset, containing 813,684 records, using Forward DNS.
"We have a list of vulnerable stores, so if we query any of them, we would get a breakdown of monthly revenue data in USD of the current store during its lifetime," the researcher added.

"This was tested on 800,000 merchant stores, +12,100 of them were exposed, +8700 were vulnerable stores that we were able to obtain their sales and traffic data and they should not be public, and 3400 are expected to have their sales data public," Fathi said.
Click to expand...

Rasheed187 · Apr 20, 2019

This is really embarrassing, makes you think about just how secure these e-commerce tools are.

Log in or Sign up

Shopify API flaw offered access to revenue data of thousands of stores

guest Guest

Rasheed187 Registered Member

Log in or Sign up

Shopify API flaw offered access to revenue data of thousands of stores

guest Guest

Rasheed187 Registered Member

Useful Searches