Slack Chat Detection - UDP #1

Binary data 9604.prm...

HackerOne: Slack integration setup lacks CSRF protection

Details: Summary: Cross-site Request Forgery in the Integrations https://hackerone.com/YOURTEAM/integrations feature for teams. Description Include Impact: The Integrations flow is insecure, because it can be abused by CSRF. PoC: Request GET https://hackerone.com/auth/slack HTTP/1.1 Response...

Slack: Email information leakage for certain addresses

@procode701 discovered a bug related to a specific configuration with our third-party email infrastructure provider, which had the potential to leak certain information from email on non-product Slack domains for specific addresses. Slack applied a fix to the configuration and performed a thoroug...

How I snooped into your private Slack messages [Slack Bug bounty worth $2,500]

When researching about MX records of slack.com, I noticed that they used a 3rd party email service. In that service, however slack.com was already claimed. After a little more research, I found that all the sub-domains of slack.com like teamname.slack.com also had MX set to the same service. Thes...

Slack: Rate-limit bypass

Hello Slack, This vulnerability is about a 2FA Bypass, On Slack Web Application there is rate limit implemented. After performing 4-6 failed 2FA Attempt, Rate limit logic will ge Triaged and ask user to wait for next attemptpreventing automated 2FA Attempts I tested the same using iOS AppiOS 9.3....

Slack: Race Condition in account survey

There exists a race condition in the beginning survey, allowing a user to get $100 in credit multiple times. In my example, I made 2 asynchronous requests, and was credited with $200. POC: 1. Create a new slack team. 2. Set your password, and find the account creation survey. 3. Complete the...

Slack: Snooping into messages via email service

@uranium238 discovered a vulnerability with a 3rd party email integration provider which would allow messages in Slack email integrations to be leaked. We worked with the 3rd party to get this issue resolved, and performed a thorough investigation to confirm that this had never been exploited...

Slack: Code Injection in Slack's Windows Desktop Client leads to Privilege Escalation

Hi, This report is about a Code Injection vulnerability in Slack's Windows Desktop Client slack.exe that allows any local user to inject code into other user's Slack client. It has been verified on a fully patched english Windows 7 64bit running the latest available Slack Desktop Client 2.1.1...

Slack: Stored XSS(Cross Site Scripting) In Slack App Name

Hello Slack, This vulnerability is about a Stored Cross Site Scripting Slack Stored XSS In AppApp Name Vulnerable URLEdit App Page https://api.slack.com/apps/appid/general https://api.slack.com/apps/A21B3V9GA/general Vulnerable Parameter = name Note -Its also work on other user as well. Send this...

Slack: CSRF - Add optional two factor mobile number

Description ==================== Adding a mobile number for 2-factor authentication is vulnerable to CSRF, allowing an attacker to bypass 2-factor authentication. An attacker would be able to force the logged in user to add a new mobile number for 2-factor authentication. The attacker would then...

Slack: Creating Post on a restricted channel

Hi, I would like to report a privilege escalation issue in which a member of the team is able to create a post on a channel even if the permission to do so is denied to him by the admin.After the admin has limited the number of users who can post to a specific public channel,an unauthorized user...

Slack: a stored xss issue in https://files.slack.com

when making a BoxNote snippet with this xss payload: XSS" ; " when snippet made: and use the "view raw" xss payload will be executed my ex: link where xss payload executed: https://files.slack.com/files-pri/T027N7MK3-F1NCA92JF/XSSscriptimgsrcimgsrcsearchonerroralertXssmarqueeboxnote.boxnote that...

Slack: "a stored xss issue in share post menu"

good day: when a team mate named an xss payload: ex: " " that xss payload will execute when making a post then share it, to a team that has an xss payload named. that shared as a direct message please see screenshot when making post here: https://hunter22.slack.com/files/create/space...

Slack: Generate new Test token

We can generate a token test in any community that we are to use the API in the community although we are not community managers In the attached video, I show you how to generate a token in a community in which I am not administrator and I can check absolutely everything and even make use of the...

Slack: User can start call in a channel of an unpaid account

Found a super minor issue that allows a user to start a call in a channel of an unpaid account. Besides the minor financial incentive for an attacker, this doesn't have a super high impact. Wanted to let you know anyway since it's not possible through the UI by default. To reproce it, start by...

Slack: Unauthenticated Access to some old file thumbnails

File thumbnails which were uploaded before the implementation of auth checks do not have those checks retroactively applied. However, their URLs contain a secret which prevents guessing or brute-forcing of their location. Well, since you hid all the details which is why I requested disclosure in...

Slack: File upload over private IM channel

A team member can upload the files in the private IM chat channel of other members.This can be done by using the IM channel id. Please refer to the attached POC's. Let me know if any more details are needed...

Slack: [Screenhero] Subdomain takeover

Hi, I found out some neglected DNS records that can be exploited to takedown the subdomain of Slack's acquisition feedback.screenhero.com The security issue is that you have CNAME record that points feedback.screenhero.com to a screenhero.uservoice.com, but the problem is that the service is...

Slack Plugs Token Security Hole

Popular collaboration and communication firm Slack rushed to plugged a security hole in its platform Thursday that was leaking some of its users’ private chats and files for anyone to access. Slack, a leading tool used by companies to communicate internally, was alerted by security firm Detectify...

Slack: Stored XSS on team.slack.com using new Markdown editor of posts inside the Editing mode and using javascript-URIs

Hi, I noticed while looking at an old article I made a while ago that some links were actually inserted as javascript:-links. Doing some modifications to these actually revealed that inside editing mode, no protection is added for getting arbitrary scripts to run. This means that by catching the...