HTML Injection inside Slack promotional emails

How it was found

Hi,

There's a HTML injection vulnerability present inside emails sent from slack when the FIRST name on the account contains HTML. The html is stored in the backend database and when emails are sent (promotional, etc), the HTML is sent along with the rest of the email.

In my PoC, which is provided below, i inserted a <img> tag to prove this vulnerability exists.

F268173

Impact

This vulnerability can lead to the reformatting/editing of emails from an official slack email address, which can be used in targeted phishing attacks.

This could lead to users being tricked into giving logins away to malicious attackers.