GHSA-vj26-42vf-4x4v: 
PHP vulnerability analysis and mitigation

Summary

kyon147/laravel-shopify did not consistently bind the shop a request acts on to the shop that was authenticated by the Shopify session token. Under certain conditions, a user of one store installed on an app could act as another store installed on the same app, including creating or changing billing charges for that store. In SPA mode, some routes could be reached without a valid session token. The billing callback also did not verify that the approved Shopify charge matched the plan being activated, which allowed a merchant to be assigned a different plan from the one they approved.

Impact

• Cross-tenant access to another store's data and actions within the app. What is exposed depends on each app's own routes.
• Unauthorized billing: creating or activating charges, and adding usage charges to another merchant's subscription.
• Plan substitution, causing revenue loss for app developers. All releases up to and including 27.1.2 are affected.

Patches

Fixed in 25.2.1, 26.1.1 and 27.1.3. Versions below 25.x will not be patched. Please upgrade to a supported release. The fix includes behaviour changes: every verify.shopify route now requires a valid session token, and requests whose shop doesn't match the token are rejected with HTTP 403. See the release notes for each version before upgrading.

Workarounds

None. Upgrading is required. Apps should also make sure their own controllers get the shop from $request->user() rather than from request input such as shop.