HexBrain

Slack · Report #148848

"a stored xss issue in share post menu"

Validstatus
$500bounty
8upvotes
25 Jun 2017disclosed

How it was found

good day:

when a team mate named an xss payload: ex: "><img src=x onerror=alert(1)> "><img src=x onerror=alert(1)> that xss payload will execute when making a post then share it, to a team that has an xss payload named. that shared as a direct message please see screenshot

when making post here: https://hunter22.slack.com/files/create/space

This report was disclosed publicly on HackerOne and belongs to its author and the program. See the original