Slack · Report #356765
Internal SSRF bypass using slash commands at api.slack.com
Validstatus
mediumseverity
51upvotes
12 Jul 2018disclosed
Summary
@albatraoz found a bypass to report #61312, allowing information leakage via SSRF in Slash commands. We fixed the vulnerability and performed a through investigation. Thanks @albatraoz!
How it was found
The write-up for this report has not been downloaded yet, or the program disclosed it without one. Read it on HackerOne.