Linux Vulnerability Scanner: Vuls

Vulnerability scanner for Linux, agentless, written in golang For a system administrator, having to perform security vulnerability analysis and software update on a daily basis can be a burden. To avoid downtime in production environment, it is common for system administrator to choose not to use...

Slack: Access to some Slack workspace metadata and settings available to unauthorized parties

In April 2016, @secalert alerted us to a vulnerability which may have allowed access to some Slack workspace metadata and settings to unauthorized parties. We implemented an initial fix within minutes, and a complete fix within two weeks. Nothing further is required from users to be protected...

Slack: Authentication bypass leads to sensitive data exposure (token+secret)

@secalert discovered an information disclosure on our server which took advantage of an authorization error that allowed the viewing of sensitive information on the server. We mitigated the issue and no longer expose such information, and performed an investigation to verify that no unauthorized...

Slack: Bypass two-factor authentication

If a user set 2FA, a user has to enter verification code when a user tries to reset password. Under the "Password Reset" page, a user can enter wrong two-factor authentication code many times. I said "many times" because your bug bounty policy stated... Exclusions Issues found through automated...

Slack: an xss issue in https://hunter22.slack.com/help/requests/793043

good day: i found an xss issue when making a help request.. https://hunter22.slack.com/help/requests/new with this xss payload: Click here click this link when try to comment the xss payload , then upon clicking xss payload executed...

Slack: Trick make all fixed open redirect links vulnerable again

this trick make all fixed open redirect links vulnerable again in this resolved report "https://hackerone.com/reports/2622" before fixing this link "https://slack.com/checkcookie?redir=http://www.example.com" redirect victim to "http://www.example.com" after fixing this link...

Slack: Executing scripts on slack-files.com using SVG

Impact Although slack-files.com is a sandbox domain, there are many ways to gain the victim's trust during phishing attack. For example, an attacker might render a fake log-in form with "You need to sign in to see this file" message and trick users into handing out their passwords. Steps to...

Slack: Reflected Self-XSS in Slack

Go to https://domainname.slack.com/services/new 2. In the searchbar, type an XSS payload I used 3. Hit Enter 4. XSS pop-up Thanks! I have provided POCs...

Slack: File upload XSS (Java applet) on http://slackatwork.com/

The web application supports file uploads and I was able to upload a Java Applet .class/.jar file. If a web browser loads a Java applet from a trusted site, the browser provides no security warning. If an attacker can upload a CLASS/JAR file with an applet, the file is executed even if the web...

Slack: Stored XSS in Slack (weird, trial and error)

Hi slack. I found a weird, trial and error Stored XSS in Slack... I hope you can get clear of this and get it too.. and I hope you can find the XSS too. Anyway here it is according to what I did: 1. Go to your Slack or create a new Slack team. 2. In slackbot.. enter this payload: 3. Then, Create ...

Slack: Self-XSS in posts by formatting text as code

Hi I have found an XSS in Slack. To reproduce the issue, just follow this: 1. Go to your Slack account accountname.slack.com 2. Below you will see a plus + sign, click that, there will be three options, click "Create Post" 3. You will be redirected to a page where you will create it. 4. Type the...

Slack: OSX slack:// protocol handler javascript injection

The Mac Slack app version 1.1 introduced the slack:// protocol handler. Due to improper input sanitization, arbitrary Javascript code can be run in the context of the client app if the user clicks on a slack:// link on a website or email. I have confirmed this issue still exists in the 1.1.1...

slack-redir.net Open Redirect vulnerability

Open Bug Bounty ID: OBB-69099 Description| Value ---|--- Affected Website:| slack-redir.net Vulnerable Application:| Custom Code Vulnerability Type:| Open Redirect / CWE-601 CVSSv3 Score:| 3.4 CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:N/I:L/A:N Remediation Guide:| OWASP Open Redirect Cheat Sheet...

Slack: Link vulnerability leads to phishing attacks

Hello Guys, Hope you are doing great. I'm sending this email to let you know about a vulnerability i stumbled upon while using slack it's a great app!. While copy-pasting a link from a pdf to slack desktop/web, i noticed that the resulting links looked a bit messed up 1.png Firing up burp and...

Slack: Bypass of the SSRF protection (Slack commands, Phabricator integration)

Abstract Some Slack features like "Integrations / Phabricator" and "Integration / Slash Commands" allow users to submit URL that will be accessed by the backend servers. A blacklist tries to forbid access to internal resources loopback, 10.0.0.0/8, 192.168.0.0/24, .... This blacklist can be...

Slack: Logout any user of same team

It is possible for a user to logout other member of same team even if they had selected Keep me signed in option. Steps to Verify: 1. Login to your team i.e https://yourteamname.slack.com. 2. On new tab on the same browser request a url which would be like...

Slack Discloses Breach of its User Profile Database

Enterprise and small business collaboration provider Slack today disclosed that a database storing user profile information has been compromised. The company said in a notice posted on its site that the unauthorized access has been blocked, and that it has implemented two-factor authentication...

Slack: Team admin can add billing contacts

Billing contacts can only be added by team owners. However, team admin can escalate his privileges and add billing contacts. Steps to reproduce: 1.Log in as team admin 2.Send the below request using his token and it adds '[email protected]' to billing contacts. POST /api/team.billing.addContact...

Slack: Team admin can change unauthorized team setting (allow_message_deletion)

Team admin can escalate his privileges and change 'allowmessagedeletion' team setting, which can be changed only by a team owner. Steps to reproduce: 1. Log in as team admin. 2. Send the below request using his cookie & token and notice that it changes 'allowmessagedeletion' team setting to true...

Slack: Team admin can change unauthorized team setting (require_at_for_mention)

Team admin can escalate his privileges and change 'requireatformention' team setting, which can be changed only by a team owner. Steps to reproduce: 1. Log in as team admin 2. Send the below request using his token and notice that it changes 'requireatformention' setting to true. POST...