Slack: CSV export/import functionality allows administrators to modify member and message content of a workspace

On August 6th, 2022 @security-warrior submitted a report in HackerOne to Slack regarding the CSV export/import functionality primarily used by administrators to merge workspaces. The report centers on the ability of an administrator to modify an export to change user or message content. Upon...

Slack Resets Passwords After a Bug Exposed Hashed Passwords for Some Users

Slack said it took the step of resetting passwords for about 0.5% of its users after a flaw exposed salted password hashes when creating or revoking shared invitation links for workspaces. "When a user performed either of these actions, Slack transmitted a hashed version of their password to othe...

A Slack Bug Exposed Some Users’ Hashed Passwords for 5 Years

The exposure of cryptographically scrambled passwords isn’t a worst-case scenario—but it isn’t great, either...

GSD-2022-1004951 hashed password of the user who created or revoked the link disclosure in Slack version between April 17, 2017 and July 17, 2022

In Slack between April 17, 2017 and July 17, 2022 if a shared invite link was created or revoked the hashed password of the user who created or revoked the link would have been disclosed in the invitation link, allowing an attacked viewing the invitation link to see the hashed password also salte...

Slack Morphism Information Disclosure Vulnerability

Slack Morphism is a modern asynchronous client library for Rust with support for Slack Web/Events API/Socket Mode and Block Kit. An information disclosure vulnerability exists in Slack Morphism versions prior to 0.41.0, which stems from the potential disclosure of Slack OAuth client information i...

slack-morphism-hyper (>=0.10.0 <=0.40.0), slack-paste (=0.1.0) potentially affected by CVE-2022-31162 via slack-morphism (>=0.10.0 <=0.40.0)

slack-morphism CARGO version =0.10.0, =0.10.0, =0.40.0 - slack-paste =0.1.0 Source cves: CVE-2022-31162 Source advisory: OSV:RUSTSEC-2022-0086...

Slack OAuth Secrets leak in debug logs

Debug log formatting made it possible to leak OAuth secrets into debug logs. The patched version has introduced more strict checks to avoid this...

RUSTSEC-2022-0086 Slack OAuth Secrets leak in debug logs

Debug log formatting made it possible to leak OAuth secrets into debug logs. The patched version has introduced more strict checks to avoid this...

CVE-2022-31162

Slack Morphism is an async client library for Rust. Prior to 0.41.0, it was possible for Slack OAuth client information to leak in application debug logs. Stricter and more secure debug formatting was introduced in v0.41.0 for OAuth secret types to reduce the possibility of printing sensitive...

Information disclosure

Slack Morphism is an async client library for Rust. Prior to 0.41.0, it was possible for Slack OAuth client information to leak in application debug logs. Stricter and more secure debug formatting was introduced in v0.41.0 for OAuth secret types to reduce the possibility of printing sensitive...

Slack Morphism 安全漏洞

Slack Morphism is a modern asynchronous client library for Rust with support for Slack Web/Events API/Socket Mode and Block Kit. An information disclosure vulnerability exists in Slack Morphism versions prior to 0.41.0, which stems from the potential disclosure of Slack OAuth client information i...

CVE-2022-31162

CVE-2022-31162 affects Slack Morphism (Rust) prior to 0.41.0. The root issue was overly verbose debug formatting that could cause Slack OAuth client information to leak into application logs. Exploitation guidance is not provided in the documents; however, various sources confirm an information d...

CVE-2022-31162 Slack Morphism for Rust before 0.41.0 can accidentally leak Slack OAuth client information in application debug logs

Slack Morphism is an async client library for Rust. Prior to 0.41.0, it was possible for Slack OAuth client information to leak in application debug logs. Stricter and more secure debug formatting was introduced in v0.41.0 for OAuth secret types to reduce the possibility of printing sensitive...

CVE-2022-31162 Slack Morphism for Rust before 0.41.0 can accidentally leak Slack OAuth client information in application debug logs

Slack Morphism is an async client library for Rust. Prior to 0.41.0, it was possible for Slack OAuth client information to leak in application debug logs. Stricter and more secure debug formatting was introduced in v0.41.0 for OAuth secret types to reduce the possibility of printing sensitive...

slack-morphism-hyper (>=0.10.0 <=0.40.0), slack-paste (=0.1.0) potentially affected by CVE-2022-31162 via slack-morphism (>=0.10.0 <=0.40.0)

slack-morphism CARGO version =0.10.0, =0.10.0, =0.40.0 - slack-paste =0.1.0 Source cves: CVE-2022-31162 Source advisory: OSV:GHSA-99J7-MHFH-W84P...

Slack Morphism for Rust before 0.41.0 can leak Slack OAuth client information in application debug logs

Impact Potential/accidental leaking of Slack OAuth client information in application debug logs. Patches More strict and secure debug formatting was introduced in v0.41 for OAuth secret types to avoid the possibility of printing sensitive information in application logs. Workarounds Don't...

GHSA-99J7-MHFH-W84P Slack Morphism for Rust before 0.41.0 can leak Slack OAuth client information in application debug logs

Impact Potential/accidental leaking of Slack OAuth client information in application debug logs. Patches More strict and secure debug formatting was introduced in v0.41 for OAuth secret types to avoid the possibility of printing sensitive information in application logs. Workarounds Don't...

PT-2022-20577 · Slack · Slack Morphism

Name of the Vulnerable Software and Affected Versions: Slack Morphism versions prior to 0.41.0 Description: The issue concerns the potential leakage of Slack OAuth client information into application debug logs due to insecure debug log formatting. This could lead to the accidental exposure of...

Mattermost Resource Management Error Vulnerability (CNVD-2022-65347)

Mattermost is an open source collaboration platform from Mattermost, Inc. Mattermost 6.7.0 and earlier versions are vulnerable to a resource management error, which stems from the inability of the Slack import feature to properly limit the size of imported files, and can be exploited to import...

Slack: Hashed data exposure via WebSockets to Workspace Members

A vulnerability in Slack's system allowed for the exposure of members' email addresses and sensitive data through WebSockets. This occurred when users created or revoked a Shared Invite Link for their workspace, resulting in the transmission of hashed passwords to other workspace members. The iss...