#SLACK DESKTOP DOWNLOAD FILES WINDOWS#

In addition to being an information-disclosure concern (attackers could access sensitive company documents, financial data, patient records and anything else someone shares via the platform), the vulnerability could be used as a jumping-off point for broader attacks. Success here would require knowing which RSS feeds the target Slack user subscribes to, of course.

Once posted to this subreddit, our test Slack channel (that is subscribed to this subreddit feed), is now populated with the new article entry and previews the text which includes the link.вЂќ вЂњI will drop an http link (because slack:// links are not allowed to be hyperlinked on Reddit) that will redirect to our malicious slack:// link and change settings when clicked. Here I could make a post to a very popular Reddit community that Slack users around the world are subscribed to (in this test case however, I chose a private one I owned),вЂќ Wells said.

In the second scenario, an outsider could place crafted hyperlinks into pieces of content that could be pulled into a Slack channel via external RSS feeds. In the first scenario, an insider could exploit the vulnerability for corporate espionage, manipulation or to gain access to documents outside of their role or privilege level.

вЂњAfter setting up a remote SMB share, we could send users or channels a link that would redirect all downloads to it after they click the link.вЂќ Remote ExploitationДЄn attack can be carried out by both authenticated and unauthenticated users, Wells said. вЂњAn SMB share, however, completely bypassed this sanitation as there is no root drive needed,вЂќ Wells explained. The Slack application filters certain characters out вЂ“ including colons вЂ“ so an attacker canвЂ™t supply a path with a drive root. The reason it has to be an SMB share is because of a security check built into the platform. вЂњThis download path can be an attacker-owned SMB share, which would cause all future documents downloaded in Slack to be instantly uploaded to the attackerвЂ™s server.вЂќ вЂњ the вЂslack://вЂ™ protocol handler, which has the capability to change sensitive settings in the Slack Desktop Application,вЂќ Wells said in a posting on Friday. Victims can still open the downloaded document through the application, however, that will be done from the attackerвЂ™s Server Message Block (SMB) share.

#SLACK DESKTOP DOWNLOAD FILES WINDOWS#

Nefarious types could redirect the files to their own SMB server and, they could manipulate the contents of those documents, altering information or injecting malware.ДЄccording to Tenable ResearchвЂ™s David Wells, who discovered the bug and reported it via the HackerOne bug-bounty platform, a download hijack vulnerability in Slack Desktop version 3.3.7 for Windows would allow an attacker to post a specially crafted hyperlink into a Slack channel that changes the document download location path when clicked. A remotely exploitable vulnerability in the Windows desktop app version of the Slack collaboration platform has been uncovered, which allows attackers to alter where files from Slack are downloaded.

Slack desktop download files