Mass account takeovers using HTTP Request Smuggling on https://slackb.com/ to steal session cookies Analysed #737140 Valid Injection and Smuggling – 2020-03-12 – 870 Remote Code Execution in Slack desktop apps + bonus Analysed #783877 Valid Command and Code Injection – 2020-08-28 – 509 XSS vulnerable parameter in a location hash Analysed #146336 Valid Cross-site Scripting – 2019-10-16 – 455 URL link spoofing Analysed #481472 Valid Input Validation and Logic – 2020-04-26 $250 362 TURN server allows TCP and UDP proxying to internal network, localhost and meta-data services Analysed #333419 Valid Server-Side Request Forgery – 2020-03-12 $3,500 323 AWS bucket leading to iOS test build code and configuration exposure Analysed #404822 Valid Information Disclosure – 2019-02-23 $1,500 321 Slack DTLS uses a private key that is in the public domain, which may lead to SRTP stream hijack Analysed #531032 Valid Cryptography – 2020-03-12 $2,000 170 XSS in gist integration Analysed #11073 Valid Cross-site Scripting – 2019-04-28 $500 157 Unauthenticated LFI revealing log information Analysed #272578 Valid Information Disclosure – 2018-01-26 – 123 Stealing xoxs-tokens using weak postMessage / call-popup redirect to current team domain #207170 Valid Misconfiguration and Insecure Design – 2017-02-28 – 120 Ability to join an arbitrary workspace by utilizing a proxy to manipulate invite links #1716016 Valid Authentication – 2023-06-23 – 109 Denial of Service via Hyperlinks in Posts #1077136 Valid Denial of Service – 2021-10-03 $1,500 109 SSRF via Office file thumbnails #671935 Valid Information Disclosure – 2022-07-05 $4,000 109 Team members can trigger arbitrary code execution in Slack Desktop Apps via HTML Notifications #816156 Valid Command and Code Injection – 2021-05-09 – 107 Stored XSS on team.slack.com using new Markdown editor of posts inside the Editing mode and using javascript-URIs #132104 Valid Cross-site Scripting – 2016-09-01 – 103 Tricking the "Create snippet" feature into displaying the wrong filetype can lead to RCE on Slack users #833080 Valid File and Path Handling – 2020-06-30 $1,500 101 Lack of URL normalization renders Blocked-Previews feature ineffectual #1102764 Valid Other weaknesses – 2022-01-16 $1,000 100 Real Time Error Logs Through Debug Information #503283 Valid Information Disclosure – 2019-04-11 – 100 Header modification results in disclosure of Slack infra metadata to unauthorized parties #727330 Valid Server-Side Request Forgery – 2021-06-09 – 97 User-assisted RCE in Slack for macOS (from official site) due to improper quarantine meta-attribute handling for downloaded files #470637 Valid No weakness recorded – 2019-09-14 – 97 Many Slack teams can be joined by abusing an improperly configured support@ inbox #239623 Valid Authentication – 2017-10-21 – 88 Bypass invite accept for victim #1663361 Valid Input Validation and Logic – 2023-02-17 – 84 SSRF in api.slack.com, using slash commands and bypassing the protections. #381129 Valid Server-Side Request Forgery – 2019-02-22 – 84 Unauthorized access to GovSlack #1758174 Valid Authentication Medium 2023-05-19 $1,500 81 Stored XSS through PDF viewer #881557 Valid Cross-site Scripting – 2022-03-16 $4,875 76 OSX slack:// protocol handler javascript injection #79348 Valid Command and Code Injection – 2016-06-24 – 72 Eavesdropping on private Slack calls #184698 Valid Authentication – 2017-02-08 $1,000 68 Access to some Slack workspace metadata and settings available to unauthorized parties #130133 Valid Authentication – 2020-11-10 $7,000 60 The Custom Emoji Page has a Reflected XSS #258198 Valid Cross-site Scripting – 2017-09-24 – 56 Bypass of the SSRF protection in Event Subscriptions parameter. #386292 Valid Server-Side Request Forgery – 2019-02-22 – 52 Internal SSRF bypass using slash commands at api.slack.com #356765 Valid Server-Side Request Forgery – 2018-07-12 – 51 [Android] Directory traversal leading to disclosure of auth tokens #1378889 Valid File and Path Handling – 2022-02-25 $3,500 50 XSS on link and window.opener #834071 Valid Cross-site Scripting – 2023-01-23 $1,000 49 Linux Desktop application slack executable does not use pie / no ASLR #415272 Valid Misconfiguration and Insecure Design – 2019-11-17 $100 47 The POODLE attack (SSLv3 supported) at status.slack.com #375097 Valid Cryptography – 2018-11-28 – 44 Store XSS #187410 Valid Cross-site Scripting – 2017-01-01 – 44 Information leakage and default open port #305518 Valid No weakness recorded – 2019-06-22 – 41 Slack-Corp Heroku application disclosing limited info about company members #966814 Valid Information Disclosure – 2020-12-09 – 39 Workspace configuration metadata disclosure #864489 Valid Information Disclosure – 2022-04-01 – 39 Private application files can be uploaded to Slack via malicious uploader #375083 Valid Information Disclosure – 2021-08-04 $500 38 CSS Injection to disable app & potential message exfil #679969 Valid Input Validation and Logic – 2019-11-09 – 37 Bypass two-factor authentication #121696 Valid Authentication – 2017-11-18 – 36 URL filter bypass in Enterprise Grid #500348 Valid Input Validation and Logic – 2020-02-14 $100 32 Access of Android protected components via embedded intent #200427 Valid Access Control – 2017-07-17 – 31 Snooping into messages via email service #163938 Valid Authentication – 2016-09-14 – 30 DoS on the Direct Messages #746003 Valid Denial of Service – 2020-11-11 $500 29 Race Condition in account survey #165570 Valid Misconfiguration and Insecure Design – 2017-11-12 – 29 Stored XSS(Cross Site Scripting) In Slack App Name #159460 Valid Cross-site Scripting – 2016-11-22 $1,000 29 Email html Injection #1461194 Valid Command and Code Injection – 2022-05-19 $250 28 Subdomain takeover on podcasts.slack-core.com #195350 Valid Cross-site Scripting – 2017-01-04 $100 27