Unauthenticated Access to some old file thumbnails

Summary

File thumbnails which were uploaded before the implementation of auth checks do not have those checks retroactively applied. However, their URLs contain a secret which prevents guessing or brute-forcing of their location.

Well, since you hid all the details which is why I requested disclosure in the first place, here goes the actual report:

Hello,

After reading these posts - https://medium.com/slack-developer-blog/important-changes-to-files-in-the-web-api-eb38f2a9c1e7#.96m8zq8nz and https://api.slack.com/types/file#authentication, it is clear that any access to file thumbnails should require authentication or the Authorization header with proper scopes defined (if accessed via the API).

However, it was observed that some of these files are accessible without any authentication required. I believe these files were uploaded before the security checks were implemented but I am not 100% sure about it. On recently uploaded files, authentication is indeed required so I believe this only applies to certain old files. Nevertheless, this is still information leakage (sensitive in some cases) and I believe all file access requests should be requiring authentication - whether old or new.

We confirmed that a lot of our files (sensitive images) that we uploaded (before 2016 around the same time when the security checks were implemented) are still accessible publicly without any authentication. This is a serious concern for us because these files (images) are sensitive and we wouldn't want anyone to get hold of them. We obviously rely on Slack to protect us against anyone accessing these old images as well even though the security checks are implemented for new files uploaded now.

I am not going to send our own files as PoC but I just google searched for "files.slack.com/files-tmb/" and came across some files that were accessible without authentication. They are listed below:

https://files.slack.com/files-tmb/T024MFP4J-F0J4R5MBN-2d878cd37b/add-new-color-scheme-inconsistency_360.png

https://files.slack.com/files-tmb/T0F8RH7U7-F0J505EG1-33434fadf3/screenshot_from_2015-12-28_15_23_39_160.png

PS - some of these files that were publicly accessible were shared in private channels as well so it is not like only images shared in public channels were accessible.