Slack: an xss issue in https://hunter22.slack.com/help/requests/793043

good day: i found an xss issue when making a help request.. https://hunter22.slack.com/help/requests/new with this xss payload: Click here click this link when try to comment the xss payload , then upon clicking xss payload executed...

Slack: Trick make all fixed open redirect links vulnerable again

this trick make all fixed open redirect links vulnerable again in this resolved report "https://hackerone.com/reports/2622" before fixing this link "https://slack.com/checkcookie?redir=http://www.example.com" redirect victim to "http://www.example.com" after fixing this link...

Slack: Executing scripts on slack-files.com using SVG

Impact Although slack-files.com is a sandbox domain, there are many ways to gain the victim's trust during phishing attack. For example, an attacker might render a fake log-in form with "You need to sign in to see this file" message and trick users into handing out their passwords. Steps to...

Slack: Reflected Self-XSS in Slack

Go to https://domainname.slack.com/services/new 2. In the searchbar, type an XSS payload I used 3. Hit Enter 4. XSS pop-up Thanks! I have provided POCs...

Slack: File upload XSS (Java applet) on http://slackatwork.com/

The web application supports file uploads and I was able to upload a Java Applet .class/.jar file. If a web browser loads a Java applet from a trusted site, the browser provides no security warning. If an attacker can upload a CLASS/JAR file with an applet, the file is executed even if the web...

Slack: Stored XSS in Slack (weird, trial and error)

Hi slack. I found a weird, trial and error Stored XSS in Slack... I hope you can get clear of this and get it too.. and I hope you can find the XSS too. Anyway here it is according to what I did: 1. Go to your Slack or create a new Slack team. 2. In slackbot.. enter this payload: 3. Then, Create ...

Slack: Self-XSS in posts by formatting text as code

Hi I have found an XSS in Slack. To reproduce the issue, just follow this: 1. Go to your Slack account accountname.slack.com 2. Below you will see a plus + sign, click that, there will be three options, click "Create Post" 3. You will be redirected to a page where you will create it. 4. Type the...

Slack: OSX slack:// protocol handler javascript injection

The Mac Slack app version 1.1 introduced the slack:// protocol handler. Due to improper input sanitization, arbitrary Javascript code can be run in the context of the client app if the user clicks on a slack:// link on a website or email. I have confirmed this issue still exists in the 1.1.1...

slack-redir.net Open Redirect vulnerability

Open Bug Bounty ID: OBB-69099 Description| Value ---|--- Affected Website:| slack-redir.net Vulnerable Application:| Custom Code Vulnerability Type:| Open Redirect / CWE-601 CVSSv3 Score:| 3.4 CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:N/I:L/A:N Remediation Guide:| OWASP Open Redirect Cheat Sheet...

Slack: Link vulnerability leads to phishing attacks

Hello Guys, Hope you are doing great. I'm sending this email to let you know about a vulnerability i stumbled upon while using slack it's a great app!. While copy-pasting a link from a pdf to slack desktop/web, i noticed that the resulting links looked a bit messed up 1.png Firing up burp and...

Slack: Bypass of the SSRF protection (Slack commands, Phabricator integration)

Abstract Some Slack features like "Integrations / Phabricator" and "Integration / Slash Commands" allow users to submit URL that will be accessed by the backend servers. A blacklist tries to forbid access to internal resources loopback, 10.0.0.0/8, 192.168.0.0/24, .... This blacklist can be...

Slack: Logout any user of same team

It is possible for a user to logout other member of same team even if they had selected Keep me signed in option. Steps to Verify: 1. Login to your team i.e https://yourteamname.slack.com. 2. On new tab on the same browser request a url which would be like...

Slack Discloses Breach of its User Profile Database

Enterprise and small business collaboration provider Slack today disclosed that a database storing user profile information has been compromised. The company said in a notice posted on its site that the unauthorized access has been blocked, and that it has implemented two-factor authentication...

Slack: Team admin can add billing contacts

Billing contacts can only be added by team owners. However, team admin can escalate his privileges and add billing contacts. Steps to reproduce: 1.Log in as team admin 2.Send the below request using his token and it adds '[email protected]' to billing contacts. POST /api/team.billing.addContact...

Slack: Team admin can change unauthorized team setting (allow_message_deletion)

Team admin can escalate his privileges and change 'allowmessagedeletion' team setting, which can be changed only by a team owner. Steps to reproduce: 1. Log in as team admin. 2. Send the below request using his cookie & token and notice that it changes 'allowmessagedeletion' team setting to true...

Slack: Team admin can change unauthorized team setting (require_at_for_mention)

Team admin can escalate his privileges and change 'requireatformention' team setting, which can be changed only by a team owner. Steps to reproduce: 1. Log in as team admin 2. Send the below request using his token and notice that it changes 'requireatformention' setting to true. POST...

Slack: a stored xss in slack integration https://onerror.slack.com/services/import

location of the stored xss bug : https://hunter22.slack.com/admin/name in team name :put this payload :" stored xss executed here: https://hunter22.slack.com/services/import...

Slack: HTTP Strict Transport Policy not enabled on newly made accounts

Hey As we know that the HSTS prevents MITM against SSL. I just checked the headers of the account i created localhost.slack.com SERVER RESPONSE: 200 OK Cache-Control: private, no-cache, no-store, must-revalidate Content-Encoding: gzip Content-Type: text/html; charset="utf-8" Date: Wed, 03 Sep 201...

Slack: Content Spoofing all Integrations in https://team.slack.com/services/new/

Hello There, I've discovered 48+ content spoofing and confirmed all of your Integrations at https://team.slack.com/services/new/ is vulnerable to Content spoofing and exploitable to all users. Content Spoofing An attack technique used to trick a user into thinking that fake web site content is...

Slack: Content spoofing at Stripe Integrations

I have found Content Spoofing Vulnerable in Slack at Stripe Integrations vulnerability is exploitable to all users Proof of concept: https://asdasda.slack.com/services/2481499413?error=content%20spoofing%20! Regards, Jayson Zabate...