Stored XSS in www.slack-files.com

Disclosed: 2014-05-23 22:59:09 By prakharprasad To slack
Unknown
Vulnerability Details
Hi, We can create posts under https://subdomain.slack.com/files/create/post Post will have XSS payload like "><img src=x onerror=alert(10);> in title and body We save it and hit "Create public link" and once we share the link it will trigger XSS. Example/POC: https://slack-files.com/T025LLJ2X-F025N8W7W-3a5691 Thanks Prakhar Prasad
Actions
View on HackerOne
Report Stats
  • Report ID: 2617
  • State: Closed
  • Substate: resolved
  • Upvotes: 6
Share this report