Slack · Report #97683

Reflected Self-XSS in Slack

Validstatus

2upvotes

10 Nov 2015disclosed

How it was found

Go to https://(domainname).slack.com/services/new
In the searchbar, type an XSS payload (I used <img src=x onerror=alert(document.domain)>)
Hit Enter
XSS pop-up

Thanks!

I have provided POCs

This report was disclosed publicly on HackerOne and belongs to its author and the program. See the original