Category: General|Sep 2, 2020 | Author: Admin

Critical Slack Bug Allows Access to Private Channels, Conversations

Share on

The RCE bug affects versions below 4.4 of the Slack desktop app.

A critical vulnerability in the popular Slack collaboration app would allow remote code execution (RCE). Attackers could gain full remote control over the Slack desktop app with a successful exploit — and thus access to private channels, conversations, passwords, tokens and keys, and various functions. They could also potentially burrow further into an internal network, depending on the Slack configuration, according to a security report.

The bug (rated between nine and 10 on the CvSS vulnerability-severity scale), was disclosed on Friday and involves cross-site scripting (XSS) and HTML injection. Slack for Desktop (Mac/Windows/Linux) prior to version 4.4 are vulnerable.

“With any in-app redirect-logic/open redirect, HTML or JavaScript injection, it’s possible to execute arbitrary code within Slack desktop apps,” wrote a bug-hunter going by the handle “oskarsv,” who submitted a report on the bug to Slack via the HackerOne platform (earning $1,500). “This report demonstrates a specifically crafted exploit consisting of an HTML injection, security control bypass, and an RCE JavaScript payload.”

According to the disclosed technical writeup, attackers could trigger an exploit by overwriting Slack desktop app “env” functions to create a tunnel via BrowserWindow; to then execute arbitrary JavaScript, in what is “a weird XSS case,” he said.

Technical Details
To exploit the bug, attackers would need to upload a file to their own HTTPS-enabled server with a payload; then, they could prepare a Slack post with an HTML injection containing the attack URL pointing to that payload (hidden in an image). After that, they need only to share that post with a public Slack channel or user. If a user clicks on the booby-trapped image, the code will be executed on the victim’s machine.

As for accomplishing the HTML injection, the issue lies in the way Slack posts are created, according to the researcher.

“[Creating a post] creates a new file on https://files.slack.com with [a specific] JSON structure,” according to the writeup. “It’s possible to directly edit this JSON structure, which can contain arbitrary HTML.”

oskarsv added, “JavaScript execution is restricted by Content Security Policy (CSP) and various security protections are in place for HTML tags (i.e. banned iframe, applet, meta, script, form, etc. and target attribute is overwritten to _blank for A tags). However, it is still possible to inject area and map tags, which can be used to achieve a one-click-RCE.” He further explained that the URL link to the malicious payload could be written within the area tag.

Alternatively, oskarsv also discovered that emails (when sent as plaintext) are stored unfiltered on Slack servers – a situation that can be abused in order to store the RCE payload without attackers needing to own their own hosting.

“Since it’s a trusted domain, it could contain a phishing page with a fake Slack login page or different arbitrary content which could impact both security and reputation of Slack,” he explained. “There are no security headers or any restrictions at all as far as I could tell and I’m sure some other security impact could be demonstrated with enough time.”

Regardless of approach, exploits can be used to execute any attacker-provided command, according to the researcher.

“The payload can be easily modified to access all private conversations, files, tokens, etc., without executing commands on the user’s computer,” he wrote, “[or] access to private files, private keys, passwords, secrets, internal network access, etc.”

Further, the payload could be made “wormable” so that it re-posts to all user workspaces, the researcher added.

Users should make sure their Slack desktop apps are upgraded to at least version 4.4 in order to avoid attacks. The bug was patched in February but has just now been disclosed because of a HackerOne disclosure hiatus on all bugs, which was in effect for several months.

Sponsored Ads:

Comments:


Microsoft Outlook bug blocks email logins, causes app crashes

Category: IT|Oct 11, 2024 | Author: Admin

The Internet archive is down - and your user information may have been stolen

Category: IT|Oct 10, 2024 | Author: Admin

Discord blocked in Russia and Turkey for spreading illegal content

Category: IT|Oct 9, 2024 | Author: Admin

Google ordered to open up the Play Store in Epic Games antitrust ruling

Category: Google|Oct 8, 2024 | Author: Admin

Recently patched CUPS flaw can be used to amplify DDoS attacks

Category: IT|Oct 7, 2024 | Author: Admin

Google removes Kaspersky's antivirus software from Play Store

Category: Google|Oct 6, 2024 | Author: Admin

UK nuclear site Sellafield fined $440,000 for cybersecurity shortfalls

Category: IT|Oct 5, 2024 | Author: Admin

Cloudflare blocks largest recorded DDoS attack peaking at 3.8Tbps

Category: IT|Oct 4, 2024 | Author: Admin

Microsoft blocks Windows 11 24H2 on some Intel PCs over BSOD issues

Category: Microsoft|Oct 3, 2024 | Author: Admin

Microsoft Office 2024 now available for Windows and macOS users

Category: Microsoft|Oct 2, 2024 | Author: Admin

HPE Aruba Networking fixes critical flaws impacting Access Points

Category: IT|Oct 1, 2024 | Author: Admin

Verizon outage: iPhones, Android devices stuck in SOS mode

Category: Apple|Sep 30, 2024 | Author: Admin

Urgent warning issued to Android users over malicious threat affecting millions of devices

Category: Google|Sep 29, 2024 | Author: Admin

Windows Recall now can be removed, is more secure

Category: Microsoft|Sep 28, 2024 | Author: Admin

CUPS flaws enable Linux remote code execution, but there’s a catch

Category: IT|Sep 27, 2024 | Author: Admin
more