HTTP parameter pollution from outdated Greenhouse.io JS dependency

Summary

Slack's career page was using an outdated Greenhouse JavaScript dependency which resulted in an HTTP parameter pollution vulnerability. This would have allowed the loading of external Greenhouse forms (not owned by Slack). We updated the Javascript and the issue is resolved. Thanks @irvinlim!

The careers page on Slack uses a third-party service called Greenhouse.io, a recruitment platform. In this case, I found that because of an outdated JavaScript dependency (as provided from Greenhouse.io), Slack's careers page in particular was vulnerable to HTTP parameter pollution. This is similar to another report at https://hackerone.com/reports/298265.

In this case, for a given URL such as https://slack.com/careers/975649, we can append HTTP parameters to become https://slack.com/careers/975649&for=hackerone&token=602938, which pollutes the iframe URL that is loaded:

https://boards.greenhouse.io/embed/job_app?for=slack&token=975649&b=https://slack.com/careers/975649&for=hackerone&token=602938

For those interested, this was what it had looked like:

{F283587}

It should be noted that other customers of Greenhouse.io do not suffer from the same vulnerability since Greenhouse.io had patched it a while back (unsure when), but since Slack had copied the JS code into their bundle, it was not updated when Greenhouse.io had patched it.

Slack had promptly resolved this issue simply by updating their Greenhouse.io JS to the latest version. It was a pleasure to work with them.