While disclosing the flaw to Slack via its HackerOne bug bounty program, the researcher shared a detailed report about the exploit. As revealed, he found an HTTP Request Smuggling bug that could allow automated hacking of arbitrary customer accounts.
This researcher exploited an HTTP Request Smuggling bug on a Slack asset to perform a CL.TE-based hijack onto neighboring customer requests. This hijack forced the victim into an open-redirect that forwarded the victim onto the researcher's collaborator client with slack domain cookies. The posted cookies in the customer request on the collaborator client contained the customer's secret session cookie.Thus, an adversary could exploit the flaw to continue taking over random accounts, something that can lead to a huge breach. A potential attacker could also create bots to execute the attacks, thus involving automation for swift breaches.
Following his report, Slack confirmed by reproducing the exploit and worked out a fix for the bug. Both the researcher and the vendors agreed to disclose the bug publicly after ensuring a patch was implemented. They have now disclosed the bug after fixing it, whilst acknowledging the researcher’s efforts with a $6500 bounty.
The researcher Sandro Gauci, who reported this flaw, also won another bounty of $2000 for reporting a high-severity vulnerability. As revealed through the bug report, this flaw allowed a man-in-the-middle hijack and handle SRTP stream in place of Slack. While the researcher discovered and reported this vulnerability around a year ago, Slack disclosed the bug only recently after ensuring a thorough fix.
Let us know your thoughts in the comments.
