Harvest: Login bypass on travel.██████████ aka "Harvest Spring Summit 2017"

Introduction I stumbled upon http://travel.████. It looks like the portal for Harvest Spring Summit 2017 travel planning and announcement. I was able to gain access to this portal and view the travel itineraries of some of the summit's participants. A note on scope I realize this domain is not...

Monitor USB Devices: USB Canary

Monitor USB Devices for potential security breach USB Canary is a Linux tool that uses pyudev to monitor devices while your computer is locked. In case it detects someone plugging in or unplugging devices it can be configured to send you an SMS or alert you via Slack of the potential security...

GitLab: Access to GitLab's Slack by abusing issue creation from e-mail

Hi there, I found a way to become a verified GitLab team member on Slack. By doing so, I gained access to dozens of channels possibly containing sensitive information. Note that I deleted my account intidchackerone immediately afterwards and did not join, read or engage with any of those channels...

Slack - Customized SSL, Dangerous filesystem permissions vulnerabilities

HackApp vulnerability scanner discovered that application Slack published at the 'play' market has multiple vulnerabilities...

Distributed Security Alerting: Securitybot

Distributed Security Alerting Securitybot is an open-source implementation of a distributed alerting chat bot, as described in Ryan Huber’s blog post . Distributed alerting improves the monitoring efficiency of your security team and can help you catch security incidents faster and more...

Slack: Bypass to postMessage origin validation via FTP

@a1kmm- discovered a bypass to our postMessage origin check, wherein an attacker with existing MITM capabilities could use FTP to bypass validation and view XOXS tokens of victims on the local network. This was related to, and investigated at the same time as, a previous report. This issue is now...

Slack Fixes Cross-Origin Token Theft Bug

The cloud-based collaboration tool Slack was quick to fix a bug earlier this month that could have allowed an attacker to steal a user’s private Slack token. Frans Rosén, a knowledge advisor at the Swedish web security firm Detectify, uncovered the bug last week while poking around the service...

Slack: Stealing xoxs-tokens using weak postMessage / call-popup redirect to current team domain

@fransrosen discovered a vulnerability which would allow an attacker running a malicious site to steal XOXS tokens. We resolved the postMessage and call-popup redirect issues, and performed a thorough investigation to confirm that this had never been exploited. Thanks @fransrosen for an interesti...

Slack: Access of Android protected components via embedded intent

@bagipro found a vulnerability wherein a malicious and unprivileged app on the victim's phone could interact with any activity in the Slack Android app, allowing manipulation of the app in unintended ways. Thanks for the finding @bagipro! I found the following code inside com.Slack.ui.HomeActivit...

Slack: dom xss in https://www.slackatwork.com

https://www.slackatwork.com/wp-content/themes/twentyfifteen/genericons//example.html1...

Slack: Subdomain takeover on podcasts.slack-core.com

I noticed slack-core.com is used for Slack's call infrastructure. I had never seen that domain before, so I decided to find out what else was running on it. It turned out podcasts.slack-core.com was pointing to a Podcast and RSS hosting service called Feed.Press. However, there was no Feed.Press...

Slack: Eavesdropping on private Slack calls

A vulnerability exists in Slack's call functionality that allows a team member to eavesdrop on private ongoing Slack calls by inviting themselves into the conversation without the permission from either participant. By doing so they can eavesdrop on co-workers' private conversations as well as...

Slack: Information Disclosure on stun.screenhero.com

@kazan71p found an information disclosure vulnerability at stun.screenhero.com which revealed limited monitoring information. We fixed the vulnerability and conducted an investigation to confirm that this was not exploited. Thanks @kazan71p!...

Slack Chat Detection - UDP #2

Binary data 9605.prm...

Slack Chat Detection - UDP #1

Binary data 9604.prm...

Slack Chat Detection via UDP

Binary data 9606.prm...

HackerOne: Slack integration setup lacks CSRF protection

Details: Summary: Cross-site Request Forgery in the Integrations https://hackerone.com/YOURTEAM/integrations feature for teams. Description Include Impact: The Integrations flow is insecure, because it can be abused by CSRF. PoC: Request GET https://hackerone.com/auth/slack HTTP/1.1 Response...

Slack: Email information leakage for certain addresses

@procode701 discovered a bug related to a specific configuration with our third-party email infrastructure provider, which had the potential to leak certain information from email on non-product Slack domains for specific addresses. Slack applied a fix to the configuration and performed a thoroug...

How I snooped into your private Slack messages [Slack Bug bounty worth $2,500]

When researching about MX records of slack.com, I noticed that they used a 3rd party email service. In that service, however slack.com was already claimed. After a little more research, I found that all the sub-domains of slack.com like teamname.slack.com also had MX set to the same service. Thes...

Slack: Rate-limit bypass

Hello Slack, This vulnerability is about a 2FA Bypass, On Slack Web Application there is rate limit implemented. After performing 4-6 failed 2FA Attempt, Rate limit logic will ge Triaged and ask user to wait for next attemptpreventing automated 2FA Attempts I tested the same using iOS AppiOS 9.3....