Slack · Report #89505
Self-XSS in posts by formatting text as code
Validstatus
2upvotes
10 Nov 2015disclosed
How it was found
Hi I have found an XSS in Slack. To reproduce the issue, just follow this:
-
Go to your Slack account (accountname.slack.com)
-
Below you will see a plus (+) sign, click that, there will be three options, click "Create Post"
-
You will be redirected to a page where you will create it.
-
Type the payload. I used: <svg onload=alert(domain)>. then Highlight it.. on the left side, there are symbols... click it and choose this symbol: ( <>) which is for code..
-
XSS Pop-up
Youtube video for clearer details:
THANKS!