CUSTOMER STORY – SHOPIFY APPLICATION SECURITY
Shopify incident response and security testing for ShineCommerce
Following abnormal redirects affecting several storefronts, IPSIP Vietnam worked with ShineCommerce to investigate the root cause, verify the impact and assess the security of the Smind Sections application.
The Web and API penetration test identified one High-severity vulnerability, supported remediation and successfully verified the fix through retesting.
Shopify Application
WEB + API
PENTEST
ISO 27001:2022
SOC 2 Type II
BUSINESS CONTEXT AND DEMAND
Investigating the Cause of a Redirect Incident on Shopify
Some stores using Smind Sections experienced unusual redirects when shoppers performed critical actions on the storefront. After quickly removing the malicious content, ShineCommerce needed to independently verify the cause, extent of impact, and security status of the application.
CUSTOMER PROFILE
S
ShineCommerce
Developer of Smind Sections - an application that helps merchants build and customize their Shopify storefronts.
Founded
2012
Customer Reach
Global
Daily Usage
>10,000
customers use the product every day
Product Requiring Penetration Testing
Smind Sections
an application for the Shopify ecosystem
Challenges to address
3 key requirements following the incident
Identify the root cause
Trace the path of the unauthorized JavaScript code and pinpoint the component that created the entry point.
Assess web application and API Security
Evaluate Smind Sections’ authentication, session management, authorization, input handling, and business logic.
Verify remediation and complete documentation
Retest the remediation measures and provide a technical report to support engagement with Shopify’s security team.
Incident Response
Grey-box Pentest
Web & API
Retest
INCIDENT ANALYSIS
From an internal tool to redirects on the storefront
The investigation determined that the incident did not originate in Smind Sections’ core application logic. The entry point was an internal administration tool with permission to write data to a source used by the Shopify application.
01 · ENTRY POINT
Internal tool lacked access controls
A function without adequate authentication and authorization controls accepted an unauthorized request.
02 · DATA
Unauthorized JavaScript was written to the system
A function without adequate authentication and authorization controls accepted an unauthorized request.
03 · APPLICATION
Malicious code appeared on the storefront
A function without adequate authentication and authorization controls accepted an unauthorized request.
04 · OBSERVED BEHAVIOR
Shoppers were redirected
A function without adequate authentication and authorization controls accepted an unauthorized request.
SCOPE OF IMPACT
What the investigation confirmed
06
Stores reported redirect behavior.
CLIENT-SIDE
The impact was concentrated in storefront interaction flows.
NO PII LEAK
No personal data leakage was identified within the scope of the investigation.
INVESTIGATION CONCLUSION
The attack originated in an internal administration tool and subsequently affected storefronts through shared JavaScript data.
SOLUTION AND IMPLEMENTATION SCOPE
From emergency remediation to independent verification
After the incident was contained, the affected components were cleaned and the attack surface exposed by the internal tool was eliminated. IPSIP Vietnam then continued the investigation and conducted Grey-box testing of the Web application and APIs to assess their security status after remediation.
INCIDENT RESPONSE
Contain the incident and eliminate the attack surface
TO BE ADDRESSED
Remove unauthorized JavaScript from store data.
IPSIP VIETNAM’S SOLUTION
PENTEST
Investigate, test and verify remediation
SOLUTION
Analyze data, architecture, and source code to verify the cause.
TO BE ADDRESSED
Remove the mechanism for injecting custom JavaScript into the storefront.
SOLUTION
Conduct Grey-box testing of the Web application and APIs.
TO BE ADDRESSED
Clean the tampered data fields in the database.
SOLUTION
Assess authentication, session management, authorization, and business logic.
TO BE ADDRESSED
Remove the internal tool and related components from the infrastructure.
SOLUTION
Perform manual validation, assign CVSS scores, and conduct retesting.
TEST RESULTS
A high-severity vulnerability directly affecting the revenue model
Grey-box testing revealed that server-side authorization did not fully check the merchant’s subscription plan before providing paid content.
8.1
CVSS v3.1
HIGH SEVERITY
Broken Access Control
Users on the free plan could send requests directly to the installation API and obtain content from a paid section because access entitlements were not fully verified on the server side.
Classification
Broken Access Control
Impact
Unauthorized Access to Paid Content
Scope
Content installation API
Status
Fixed · Retest Verified
Changes after remediation
BEFORE REMEDIATION
Access entitlements were not verified on the server side
The API processed installation requests without fully checking the merchant’s subscription plan against the requested content.
AFTER REMEDIATION
Entitlements are checked before content is delivered
The system identifies the section’s plan requirement and checks it against a valid subscription status before writing the content to the merchant’s theme.
PROJECT OUTCOMES
From incident response to strengthening Shopify application security
The project addressed the unexpected redirects and helped ShineCommerce verify the cause, remediate vulnerabilities, and reassess the security of Smind Sections.
01 High
High-severity vulnerability identified
8.1
CVSS v3.1 score
Fixed
Status after remediation
Verified
Retest result
06
Key project outcomes
Each outcome corresponds to a step in the complete cycle: investigation, remediation, testing, and verification.
Through an end-to-end process covering incident investigation, Web/API testing, and remediation verification, IPSIP Vietnam helped ShineCommerce resolve the immediate issue and strengthen the long-term security foundation of Smind Sections.
01
Verified the root Cause
Established how malicious JavaScript was introduced through the internal tool into shared data and subsequently appeared on merchants’ storefronts.
02
Eliminated the related attack surface
Malicious code, affected data, and the script rendering mechanism were removed. The associated internal tool was also taken out of service.
03
Identified a broken access control vulnerability
Independent testing revealed that users on the free plan could access paid content when access entitlements were not checked on the server side.
04
Successfully remediated and retested the vulnerability
Server-side entitlement verification was added. IPSIP Vietnam conducted retesting and confirmed that the vulnerability had been resolved.
05
No personal data leakage identified
Within the scope of the investigation, the incident was found to affect browser-side behavior, with no evidence of personally identifiable information leakage identified.
06
Completed technical documentation
The incident report, test results, and retest evidence provided a basis for ShineCommerce’s Shopify application security review activities.
Why did ShineCommerce choose IPSIP Vietnam for Penetration Testing?
IPSIP Vietnam combines incident response and security testing expertise to help businesses resolve immediate issues and reduce the risk of recurrence.
Combining incident response and security testing
IPSIP supports the entire process - from root cause verification and impact assessment to in-depth Web/API testing - within a single project.
Assessments focused on real-world risks
Testing focuses on authentication, authorization, APIs, and business logic - areas that can directly affect users and revenue.
Clear, actionable findings
Each finding is classified by risk level, includes a description of its impact, and comes with remediation recommendations tailored to the system.
Capabilities validated against international standards
ISO 27001:2022 certification and a SOC 2 Type II attestation report demonstrate IPSIP’s commitment to controls, information security, and service delivery quality.
Strong and trusted cybersecurity protection
IPSIP combines the expertise of its security team with a solution ecosystem from SentinelOne, CrowdStrike, Fortinet, and Sekoia. Based on the required scope, suitable solutions are selected to support security monitoring and the detection and management of threats to business systems.
This approach strengthens data protection, supports stable operations, and improves response capabilities when security risks emerge.
TELL US ABOUT YOUR PROJECT
...And our team will:
Review your request within 1–2 business hours.
Provide a detailed proposal based on your project’s specific scope and requirements.
Arrange an in-depth call to discuss your project and finalize the most suitable approach.
Sign the service agreement and officially launch the project with you.
Don’t have specific requirements yet but want to learn more about our capabilities? Visit About IPSIP Vietnam to discover more about our team’s expertise.
