Slack · Report #33018
a stored xss in slack integration https://onerror.slack.com/services/import
Validstatus
$500bounty
6upvotes
22 May 2016disclosed
How it was found
location of the stored xss bug : https://hunter22.slack.com/admin/name in team name :put this payload :"><img src=x onerror=prompt(document.domain)>
stored xss executed here: https://hunter22.slack.com/services/import