Slack · Report #10297

Stored XSS in slack.com (integrations)

Validstatus

2upvotes

29 May 2014disclosed

How it was found

Hi Slack,

i'm going to report stored xss in slack integrations.

Attack String (Payload): http://jeroldcamacho.com/%5Ex1s1s/slack.com.txt

Proof of Concept: here is the video.

Thanks, Jerold Camacho

This report was disclosed publicly on HackerOne and belongs to its author and the program. See the original