I’m no stranger to stumbling upon oddities in software, and this time, I found something big—a vulnerability in a popular Shopify app, Loox Reviews that made me raise an eyebrow. Loox, a well-known reviews app that many Shopify merchants use to build credibility with customer feedback. What I found was a critical flaw that could expose sensitive customer data, all because of an insecure direct object reference (IDOR).
Please note this vulnerability was discovered and fixed in 2023, this blog post is a post-mortem.
The Vulnerability: What Was the Issue?
It all started with a seemingly innocent GET request. I was poking around the Loox reviews widget for some work project when I noticed something odd. Loox uses publicly accessible merchant IDs as part of their request URL. No big deal, right? Well, it became a big deal when I realized that by simply modifying the merchant ID in the URL, I could access another merchant’s review data—including sensitive customer information, such as email addresses, review content, and admin settings. It's one thing to access publicly-available information, product reviews in this case, but this was much more.
To make matters worse, this didn’t even require any sort of authentication. Anyone, even if not logged in to Shopify, could exploit this vulnerability. All an attacker had to do was find a merchant ID (easily scraped from public pages) and modify a URL. With that simple change, you could pull down entire CSV files filled with reviews and customer data.
The Technical Breakdown
At the core of the issue was Loox’s hash generation mechanism. When a URL is requested, Loox generates a hash via a public URL, and this process bypasses standard authentication protocols. The system allowed anyone with the right merchant ID to manipulate the URL, grab an export hash, and download review data—all without needing a valid login.
- Merchant IDs are publicly available. You can find them easily by visiting a store that uses Loox.
-
A simple GET request, like this one, with the merchant ID in the URL, was all you needed:
https://loox.io/admin/<MERCHANT_ID>/reviews?new_merchant_admin_content=true&embedded=1&status=Rejected - By modifying the
<MERCHANT_ID>parameter, I could pull review data for different merchants. - The
window.LOOX.hashvalue exposed in the web page's JavaScript gave me the final piece: an export hash to retrieve the full CSV of reviews.
Exploitation: From Discovery to Exporting Data
To really demonstrate the danger of this vulnerability, here’s how an attacker could use the export hash:
Step 1: Extract the window.LOOX.hash for a target merchant (publicly accessible).
Step 2: Use the export hash to download all reviews in CSV format using another GET request:
https://loox.io/admin/export?id=<EXPORT_HASH>
Not only was customer data exposed, but there were also additional vulnerabilities. An attacker could even change admin settings, like the "send from" email for review requests, tamper with billing plans, view integrated app's API keys, or intercept review emails—all without needing access to the merchant’s Shopify admin.
The Aftermath: Reporting and Resolution
After discovering the vulnerability, I contacted Loox support. Within two days, they acknowledged the issue and patched the vulnerability. They removed the public exposure of the window.LOOX object, which had been the key to exploiting the export hash. Loox also closed the issue and paid out a bounty for the discovery.
Timeline:
- Oct 07 2023: I found the vulnerability and reported it to Loox.
- Oct 08 2023: Loox acknowledged the issue.
- Oct 09 2023: Loox fixed the vulnerability and removed access to the
window.LOOXobject. - Oct 10 2023: The issue was resolved, and a bounty was paid out.
What’s the Impact?
This vulnerability produced a severe risk to customer privacy. The exposure of sensitive customer data—names, emails, and review content—could have led to phishing attacks, identity theft, and a massive breach of trust for Shopify merchants using Loox. The fact that an unauthenticated user could access this data with such ease only increased the seriousness of the situation.
While Loox patched the issue quickly, it’s unsettling (putting it mildly) to think about how long this vulnerability may have existed unnoticed. Potentially, an attacker could have been actively exploiting this vulnerability. It also puts in the spotlight the role of 3rd party app developers in ensuring that proper validation and authentication mechanisms are in place to protect customer data. There was a 20% increase of data breaches from 2022 to 2023. There's almost 10,000 apps on the Shopify app store, do you blindly trust all of them because they're on the app store? I'd think again.
Vulnerabilities can appear anywhere, even in apps you trust implicitly. Question that trust until its proven.