Slack vulnerability in the "Create snippet" feature can trick users to execute malicious filetypes

-


Slack’s snippet feature allows users to quickly and easily share pieces of code, configuration files, or log files within their workspace.

Researcher Kevin McSheehan discovered the bug in the snippet feature and reported it in the Slack’s bug bounty program.

"They need to click on the file, so let's trick Slack into making it look benign. CSV should work" he said.

Slack will also show the user that a .CSV file is being downloaded when it is actually a .BAT executable.

The issue, present in both the mobile and desktop versions of the app, allowed a malicious actor to disguise dangerous files as benign, due to a flaw in the create snippet feature.

The researcher discovered that by including a long file name and certain ASCII characters in the snipped content, an attacker could trick Slack into showing that a .CSV file was being downloaded when it was actually a .BAT executable.

Full details of the vulnerability can be found here - https://hackerone.com/reports/833080 and video demonstration here - https://www.youtube.com/watch?v=cIlGfnn4iG8

Twitter: @journothinker 
Instagram: @journothinker 


Comments

Post a Comment

Popular posts from this blog

Security researcher earns $15000 biggest bug bounty for Russian internet company giant Mail.Ru

-
Image
Security researcher Ramazan (r0hack) discovered a Bind (time-based) SQL injection in https://city-mobil.ru website due to the unsafe usage of the GET parameter for which he was awarded $15000 So far, this is the largest awarded vulnerability disclosed in Mail.ru and the second biggest bounty awarded on the bug bounty platform Hackerone after just one bug bounty award of $20000 Time-based SQL Injection is an SQL Injection technique that relies on sending an SQL query to the database which forces the database to wait for a specified amount of time (in seconds) before responding. The response time will indicate to the attacker whether the result of the query is TRUE or FALSE which will allow the attacker to figure out if the payload used true or false Full details of the vulnerability have not been yet polished by the researcher and more information can be found at https://hackerone.com/reports/868436 Mail.Ru is a major Russian internet company whose sites reach approxima
Read more

Over $105 Million in cash has been delivered by postmen to bank account holders across India at their doorstep

-
Image
Aadhaar is the world’s largest  biometric ID system  in India. An Aadhaar number is a 12-digit random number issued by the Government Authority to the residents of India after satisfying the verification process. Any individual, irrespective of age and gender, who is a resident can voluntarily enrol to obtain a Aadhaar number. The residents have to provide minimal demographic and biometric information to sign up which is absolutely free of cost. The uniqueness is achieved through the process of demographic and biometric data. India Post Payments Bank had introduced the Aadhaar Enabled Payment System (AePS) Services in Sept 2019. With AEPS any one with a bank account linked to their Aadhaar number can make cash withdrawals and balance enquiry regardless of their Bank. They can simply authenticate their identity with a fingerprint scan & Aadhaar authentication details to complete a transaction. AEPS is able to achieve low-cost cash delivery to the doorstep of various sections of
Read more