Slack: SSRF in api.slack.com, using slash commands and bypassing the protections.

Bypassing the reports 61312 and 356765 Tutorial: Go to api.slack.com and create an application with your own slash command. F320014 Enter your own domain: in your own domain: index.php location: http://:::22/ F320019 And save. Go to your Slack and type /youslash Try with my server...

Cryptocurrency users on Discord & Slack hit by MacOS malware

By Waqas Hackers are using a new MacOS malware aimed at cryptocurrency This is a post from HackRead.com Read the original post: Cryptocurrency users on Discord & Slack hit by MacOS malware...

Slack: Private application files can be uploaded to Slack via malicious uploader

Hi. I have found an issue which allows to retrieve any files from /data/data/com.Slack/ directory. The problem is in exported activity com.Slack.ui.UploadActivity which accepts a URI to download files. I see that you've added verification java private static boolean isPrivateFileUri uri return...

MacOS Malware Targets Cryptocurrency Community on Slack, Discord

Hackers using MacOS malware are targeting cryptocurrency investors that use both the Slack and Discord chat platforms. The malware, dubbed OSX.Dummy, uses an unsophisticated infection method, but those who are successfully attacked open their systems up to remote arbitrary code execution. “If the...

Burpa - A Burp Suite Automation Tool

A Burp Suite Automation Tool With Slack Integration. Requirements burp-rest-api Burp Suite Professional slackclient Usage $ python burpa.py -h / / / / / / / / / / / // / // / / / // / // / /./,// / ./,/ // burpa version 0.1 / by 0x4D31 usage: burpa.py -h -a scan,proxy-config,stop -pP PROXYPORT...

Salt-Scanner - Linux Vulnerability Scanner Based On Salt Open And Vulners Audit API

A linux vulnerability scanner based on Vulners Audit API and Salt Open, with Slack notifications and JIRA integration. Features Slack notification and report upload JIRA integration OpsGenie integration Requirements Salt Open 2016.11.x salt-master, salt-minion¹ Python 2.7 salt you may need to...

Slack: Internal SSRF bypass using slash commands at api.slack.com

@albatraoz found a bypass to report 61312, allowing information leakage via SSRF in Slash commands. We fixed the vulnerability and performed a through investigation. Thanks @albatraoz!...

PT-2018-1311

Name of the Vulnerable Software and Affected Versions Microsoft Windows VBScript Engine versions prior to the fixed version Description A remote code execution issue exists in the way the VBScript engine handles objects in memory. This allows remote attackers to execute arbitrary code and affect...

FreeBSD : Gitlab -- multiple vulnerabilities (085a087b-3897-11e8-ac53-d8cb8abf62dd)

GitLab reports : Confidential issue comments in Slack, Mattermost, and webhook integrations. Persistent XSS in milestones data-milestone-id. Persistent XSS in filename of merge request. C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from the...

Slack: HTTP parameter pollution from outdated Greenhouse.io JS dependency

Slack's career page was using an outdated Greenhouse JavaScript dependency which resulted in an HTTP parameter pollution vulnerability. This would have allowed the loading of external Greenhouse forms not owned by Slack. We updated the Javascript and the issue is resolved. Thanks @irvinlim! The...

Slack: TURN server allows TCP and UDP proxying to internal network, localhost and meta-data services

The TURN servers used by Slack allow TCP connections and UDP packets to be proxied to the internal network. This gives an attacker the ability to scan and interact with internal systems. The attacker may proxy TCP connections to the internal network by setting the XOR-PEER-ADDRESS of the TURN...

Slack Technologies Slack URI Parsing Command Injection Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Slack Technologies Slack. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the...

Slack: Invitation reminder emails contain insecure links

If one gets invited to a slack channel and does not act upon the invitation a while later a reminder email is sent. The links in these reminders are http links. Excerpt from the mail: ---------------------- Don’t miss out — come join the conversation! Join Now...

radio4all.net XSS vulnerability

Open Bug Bounty ID: OBB-574683 Description| Value ---|--- Affected Website:| radio4all.net Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

Slack: HTML Injection inside Slack promotional emails

Hi, There's a HTML injection vulnerability present inside emails sent from slack when the FIRST name on the account contains HTML. The html is stored in the backend database and when emails are sent promotional, etc, the HTML is sent along with the rest of the email. In my PoC, which is provided...

Slack: Information leakage and default open port

@freem0 found Prometheus plugin output that was exposed at one of our servers. The information exposed including some OS information metrics about memory usage, but no customer data was at risk and no exploit was possible. Thank you @freem0!...

Man-in-the-Middle (MitM)

github.com/nlopes/slack is vulnerable to man-in-the-middle MitM attacks. The vulnerability exists due to the usage of hardcoded non-HTTPS Slack API URL...

Slack: Shared-channel BETA persists integration after unshare

@oneiroi discovered a bug in the Shared Channels Beta wherein notifications may still be delivered to an unshared channel previously shared. This did not affect data not in notifications, and we patched and performed a thorough investigation. Thanks for the report @oneiroi!...

Slack Plugs ‘Severe’ SAML User Authentication Hole

Cloud-based communications platform Slack finished patching a severe security hole Thursday affecting portions of its platform that used the Security Assertion Markup Language SAML standard for user authentication. The flawed implementation of SAML by Slack impacted mostly enterprise customers wh...

Slack SAML authentication bypass

tl;dr I found a severe issue in the Slack's SAML implementation that allowed me to bypass the authentication. This has now been solved by Slack. Introduction IMHO the rule 1 of any bug hunter note I do not consider myself one of them since I do this really sporadically is to have a good RSS feed...