Category: General|Sep 2, 2020 | Author: Admin

Critical Slack Bug Allows Access to Private Channels, Conversations

Share on

The RCE bug affects versions below 4.4 of the Slack desktop app.

A critical vulnerability in the popular Slack collaboration app would allow remote code execution (RCE). Attackers could gain full remote control over the Slack desktop app with a successful exploit — and thus access to private channels, conversations, passwords, tokens and keys, and various functions. They could also potentially burrow further into an internal network, depending on the Slack configuration, according to a security report.

The bug (rated between nine and 10 on the CvSS vulnerability-severity scale), was disclosed on Friday and involves cross-site scripting (XSS) and HTML injection. Slack for Desktop (Mac/Windows/Linux) prior to version 4.4 are vulnerable.

“With any in-app redirect-logic/open redirect, HTML or JavaScript injection, it’s possible to execute arbitrary code within Slack desktop apps,” wrote a bug-hunter going by the handle “oskarsv,” who submitted a report on the bug to Slack via the HackerOne platform (earning $1,500). “This report demonstrates a specifically crafted exploit consisting of an HTML injection, security control bypass, and an RCE JavaScript payload.”

According to the disclosed technical writeup, attackers could trigger an exploit by overwriting Slack desktop app “env” functions to create a tunnel via BrowserWindow; to then execute arbitrary JavaScript, in what is “a weird XSS case,” he said.

Technical Details
To exploit the bug, attackers would need to upload a file to their own HTTPS-enabled server with a payload; then, they could prepare a Slack post with an HTML injection containing the attack URL pointing to that payload (hidden in an image). After that, they need only to share that post with a public Slack channel or user. If a user clicks on the booby-trapped image, the code will be executed on the victim’s machine.

As for accomplishing the HTML injection, the issue lies in the way Slack posts are created, according to the researcher.

“[Creating a post] creates a new file on with [a specific] JSON structure,” according to the writeup. “It’s possible to directly edit this JSON structure, which can contain arbitrary HTML.”

oskarsv added, “JavaScript execution is restricted by Content Security Policy (CSP) and various security protections are in place for HTML tags (i.e. banned iframe, applet, meta, script, form, etc. and target attribute is overwritten to _blank for A tags). However, it is still possible to inject area and map tags, which can be used to achieve a one-click-RCE.” He further explained that the URL link to the malicious payload could be written within the area tag.

Alternatively, oskarsv also discovered that emails (when sent as plaintext) are stored unfiltered on Slack servers – a situation that can be abused in order to store the RCE payload without attackers needing to own their own hosting.

“Since it’s a trusted domain, it could contain a phishing page with a fake Slack login page or different arbitrary content which could impact both security and reputation of Slack,” he explained. “There are no security headers or any restrictions at all as far as I could tell and I’m sure some other security impact could be demonstrated with enough time.”

Regardless of approach, exploits can be used to execute any attacker-provided command, according to the researcher.

“The payload can be easily modified to access all private conversations, files, tokens, etc., without executing commands on the user’s computer,” he wrote, “[or] access to private files, private keys, passwords, secrets, internal network access, etc.”

Further, the payload could be made “wormable” so that it re-posts to all user workspaces, the researcher added.

Users should make sure their Slack desktop apps are upgraded to at least version 4.4 in order to avoid attacks. The bug was patched in February but has just now been disclosed because of a HackerOne disclosure hiatus on all bugs, which was in effect for several months.

Sponsored Ads:


How to remove Samsung's new lock

Category: General|Jul 24, 2024 | Author: Admin

Intel: “We have found the bug”

Category: IT|Jul 23, 2024 | Author: Admin

Microsoft blames EU for Windows not being secure

Category: Microsoft|Jul 22, 2024 | Author: Admin

Chip stocks volatile with China-US spat in focus

Category: IT|Jul 21, 2024 | Author: Admin

OpenAI unveils cheaper small AI model GPT-4o mini

Category: IT|Jul 20, 2024 | Author: Admin

“iPhone 15” is struggling

Category: Apple|Jul 19, 2024 | Author: Admin

A new era for mobiles

Category: Google|Jul 18, 2024 | Author: Admin

Has opened for credit card trading of Bitcoin

Category: IT|Jul 17, 2024 | Author: Admin

Now everyone can test the new from Apple!

Category: Apple|Jul 16, 2024 | Author: Admin

Google reportedly is close to buying cybersecurity company Wiz for $23 billion

Category: Google|Jul 15, 2024 | Author: Admin

OpenAI whistleblowers ask SEC to investigate alleged restrictive non-disclosure agreements

Category: IT|Jul 14, 2024 | Author: Admin

Norwegian Vivaldi reaches out to Google

Category: IT|Jul 13, 2024 | Author: Admin

Soon, Apple fans may flee Google, and the other way around

Category: IT|Jul 12, 2024 | Author: Admin

Apple's iPhone change is fantastic for Norwegians - Vipps rejoices

Category: Apple|Jul 11, 2024 | Author: Admin

iPhone gets it five years after Android

Category: Google|Jul 10, 2024 | Author: Admin