Slack · Report #2635
csrf
Validstatus
4upvotes
6 Apr 2014disclosed
How it was found
Hi,
Anti CSRF token to prevent CSRF attacks are missing on this link https://sehacure.slack.com/help/requests/new
A new request can be submitted by an malicious guy to the support team on behalf of the user.
The victim will never get to know.
- Go to this link
https://sehacure.slack.com/help/requests/new
-
Open tamper data addon in firefox. Submit the data .
-
Tamper the reuqest there are no tokens in the requests.
Best regards, Anand