Slack · Report #148848
"a stored xss issue in share post menu"
Validstatus
$500bounty
8upvotes
25 Jun 2017disclosed
How it was found
good day:
when a team mate named an xss payload: ex: "><img src=x onerror=alert(1)> "><img src=x onerror=alert(1)> that xss payload will execute when making a post then share it, to a team that has an xss payload named. that shared as a direct message please see screenshot
when making post here: https://hunter22.slack.com/files/create/space