XSS on link and window.opener Analysed #834071 Valid Cross-site Scripting Medium 2023-01-23 $1,000 49 [Android] Directory traversal leading to disclosure of auth tokens Analysed #1378889 Valid File and Path Handling High 2022-02-25 $3,500 50 Internal SSRF bypass using slash commands at api.slack.com Analysed #356765 Valid Server-Side Request Forgery Medium 2018-07-12 – 51 Bypass of the SSRF protection in Event Subscriptions parameter. Analysed #386292 Valid Server-Side Request Forgery Medium 2019-02-22 – 52 The Custom Emoji Page has a Reflected XSS Analysed #258198 Valid Cross-site Scripting High 2017-09-24 – 56 Access to some Slack workspace metadata and settings available to unauthorized parties Analysed #130133 Valid Authentication – 2020-11-10 $7,000 60 Eavesdropping on private Slack calls Analysed #184698 Valid Authentication High 2017-02-08 $1,000 68 OSX slack:// protocol handler javascript injection Analysed #79348 Valid Command and Code Injection – 2016-06-24 – 72 Stored XSS through PDF viewer Analysed #881557 Valid Cross-site Scripting High 2022-03-16 $4,875 76 Unauthorized access to GovSlack Analysed #1758174 Valid Authentication Medium 2023-05-19 $1,500 81 SSRF in api.slack.com, using slash commands and bypassing the protections. Analysed #381129 Valid Server-Side Request Forgery Medium 2019-02-22 – 84 Bypass invite accept for victim Analysed #1663361 Valid Input Validation and Logic Medium 2023-02-17 – 84 Many Slack teams can be joined by abusing an improperly configured support@ inbox Analysed #239623 Valid Authentication – 2017-10-21 – 88 User-assisted RCE in Slack for macOS (from official site) due to improper quarantine meta-attribute handling for downloaded files Analysed #470637 Valid No weakness recorded High 2019-09-14 – 97 Header modification results in disclosure of Slack infra metadata to unauthorized parties Analysed #727330 Valid Server-Side Request Forgery Medium 2021-06-09 – 97 Real Time Error Logs Through Debug Information Analysed #503283 Valid Information Disclosure High 2019-04-11 – 100 Lack of URL normalization renders Blocked-Previews feature ineffectual Analysed #1102764 Valid Other weaknesses Medium 2022-01-16 $1,000 100 Tricking the "Create snippet" feature into displaying the wrong filetype can lead to RCE on Slack users Analysed #833080 Valid File and Path Handling High 2020-06-30 $1,500 101 Stored XSS on team.slack.com using new Markdown editor of posts inside the Editing mode and using javascript-URIs Analysed #132104 Valid Cross-site Scripting – 2016-09-01 – 103 Team members can trigger arbitrary code execution in Slack Desktop Apps via HTML Notifications Analysed #816156 Valid Command and Code Injection High 2021-05-09 – 107 SSRF via Office file thumbnails Analysed #671935 Valid Information Disclosure Critical 2022-07-05 $4,000 109 Denial of Service via Hyperlinks in Posts Analysed #1077136 Valid Denial of Service Medium 2021-10-03 $1,500 109 Ability to join an arbitrary workspace by utilizing a proxy to manipulate invite links Analysed #1716016 Valid Authentication Critical 2023-06-23 – 109 Stealing xoxs-tokens using weak postMessage / call-popup redirect to current team domain Analysed #207170 Valid Misconfiguration and Insecure Design – 2017-02-28 – 120 Unauthenticated LFI revealing log information Analysed #272578 Valid Information Disclosure High 2018-01-26 – 123 XSS in gist integration Analysed #11073 Valid Cross-site Scripting – 2019-04-28 $500 157 Slack DTLS uses a private key that is in the public domain, which may lead to SRTP stream hijack Analysed #531032 Valid Cryptography High 2020-03-12 $2,000 170 AWS bucket leading to iOS test build code and configuration exposure Analysed #404822 Valid Information Disclosure Critical 2019-02-23 $1,500 321 TURN server allows TCP and UDP proxying to internal network, localhost and meta-data services Analysed #333419 Valid Server-Side Request Forgery Critical 2020-03-12 $3,500 323 URL link spoofing Analysed #481472 Valid Input Validation and Logic Low 2020-04-26 $250 362 XSS vulnerable parameter in a location hash Analysed #146336 Valid Cross-site Scripting – 2019-10-16 – 455 Remote Code Execution in Slack desktop apps + bonus Analysed #783877 Valid Command and Code Injection Critical 2020-08-28 – 509 Mass account takeovers using HTTP Request Smuggling on https://slackb.com/ to steal session cookies Analysed #737140 Valid Injection and Smuggling Critical 2020-03-12 – 870