Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Remote Code Execution in Slack desktop apps

hackerone.com

Post reply on HN
Print view View original

131–140 of 201 posts

Re: Remote Code Execution in Slack desktop apps

#131

Post by tptacek »

justsomeuser wrote: post #106
rvz wrote: post #6

Great report on a critical RCE vulnerability in Slack. However, I will bite. $1,750 for a detailed report on a critical RCE is like rewarding sniffer-dogs with breadcrumbs. One could sell this exploit at least for 5 figures on the black market. In all cases, since Electron brings XSS to the desktop, it is a hackers paradise.

I found a XSS bug in a popular note taking app. It would allow an attacker to download all the users notes just by having them visit a URL. I reported it on HackerOne, it was only after I refused to post it on their free program that they added me to their paid private one. It was marked as "medium", I got $250 for it.

That's a pretty normal price for an XSS.

Re: Remote Code Execution in Slack desktop apps

#132

Post by tptacek »

jansommer wrote: post #66
rvz wrote: post #6

Great report on a critical RCE vulnerability in Slack. However, I will bite. $1,750 for a detailed report on a critical RCE is like rewarding sniffer-dogs with breadcrumbs. One could sell this exploit at least for 5 figures on the black market. In all cases, since Electron brings XSS to the desktop, it is a hackers paradise.

Damn, didn't know $1750 was low. I got something similar for reporting an exploit to Microsoft, where opening an attached ICS/calendar entry in Outlooks web client allowed me to execute arbitrary JavaScript on outlook.microsoft.com as the current user. Should have asked for more!

It sounds like you got $1750 for an XSS-equivalent attack. That's high for XSS.

Re: Remote Code Execution in Slack desktop apps

#133

Post by SXX »

oskarsv wrote: post #95
SXX wrote: post #78

Earlier quoted context omitted.

I haven't done any security research for decade, but it was my hobby long ago. While it's not true in every case sometimes finding worthy bug and then successfully exploiting it can literally take weeks of work. Like 14 hours a day work with break for sleep in attempt to solve some puzzle. Usually without any payoff. This is profession where your actual skills mean very little until you do something exceptional to ha…

I don't live in a 'western country' nor do I make anything near a Silicon Valley salary

Then I can just state huge respect to your moral standards and hope you getting paid well enough to continue doing what you do.

There still are a lot of people who are not gonna be okay with said situation for long. Anyone can get more cynical and cruel / indifferent with age due to bad experiences: not getting paid well for reported issues, being cheated or getting into legal trouble for "doing the right thing". Some of us really love security research and want to make it their profession, but it's really easy to end up both without stable income or in some kind of trouble.

So I think it's important to raise awareness about it in developer community since many people don't understand how much effort is going into being white hat. It's just like the story with OpenSSL before Heartbleed: half of the world used software, but there wasn't even enough funding to pay properly even for single developer.

Re: Remote Code Execution in Slack desktop apps

#134

Post by tptacek »

pansa2 wrote: post #12
rvz wrote: post #6

Great report on a critical RCE vulnerability in Slack. However, I will bite. $1,750 for a detailed report on a critical RCE is like rewarding sniffer-dogs with breadcrumbs. One could sell this exploit at least for 5 figures on the black market. In all cases, since Electron brings XSS to the desktop, it is a hackers paradise.

> since Electron brings XSS to the desktop, it is a hackers paradise. Just curious - what makes XSS on the desktop different from other kinds of RCE vulnerability?

XSS isn't ordinarily RCE, and XSS is generally much more common than the attacks that do reliably give RCE. It's notable that un-hardened Electron elevates XSS to RCE, because it means there are a lot more opportunities for RCE. That's the subtext of the comment you're replying to.

Re: Remote Code Execution in Slack desktop apps

#135

Post by tptacek »

WrtCdEvrydy wrote: post #57
slimsag wrote: post #14

Earlier quoted context omitted.

Had the researchers (unethically) published it as a zero-day vulnerability in e.g. a blog post stating "the slack payout wasn't enough for us to care" - what would've been their legal risks? I assume that would be _one_ way to get companies to care more about rewarding people who spend substantial amounts of time researching their security

A friend of mine swears that you can be sued for 'business damages' over improper disclosure. Sadly, the US is a non-permissive environment so I tend to believe it.

I think that friend of yours is almost certainly wrong, and for decades now there have been notable researchers who disclose publicly and immediately.

Re: Remote Code Execution in Slack desktop apps

#136

Post by jcelerier »

todd3834 wrote: post #103
vermilingua wrote: post #98

Earlier quoted context omitted.

You replied to a claim about “most software” with a site that compares big tech companies, and only their US offices. The world is much bigger than your bubble.

Do you have any data the counters what I’m saying? I know people in other countries don’t make the same salaries but they are “mostly” doing pretty well for their region

> I know people in other countries don’t make the same salaries but they are “mostly” doing pretty well for their region

here's some job postings for software engineer in Bordeaux, France: https://www.indeed.fr/Bordeaux-(33)-Emplois-Ingenieur-Inform...

It's around three times less.

Re: Remote Code Execution in Slack desktop apps

#137

Post by jsploit »

justsomeuser wrote: post #106
rvz wrote: post #6

Great report on a critical RCE vulnerability in Slack. However, I will bite. $1,750 for a detailed report on a critical RCE is like rewarding sniffer-dogs with breadcrumbs. One could sell this exploit at least for 5 figures on the black market. In all cases, since Electron brings XSS to the desktop, it is a hackers paradise.

I found a XSS bug in a popular note taking app. It would allow an attacker to download all the users notes just by having them visit a URL. I reported it on HackerOne, it was only after I refused to post it on their free program that they added me to their paid private one. It was marked as "medium", I got $250 for it.

Do you disagree with the severity? I assess it to have a 6.5 (medium) CVSS score.

https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:L...

Re: Remote Code Execution in Slack desktop apps

#138

Post by oskarsv »

ActorNightly wrote: post #125
oskarsv wrote: post #39

I wrote that exploit & report. Just some thoughts on comments here. Sure the bounty is low, but ultimately it's their money and their decision. They will deal with the 'consequences' of others skipping their program and some public shaming. I find everyone talking about black markets etc. kind of ridiculous. Really? You would sell something like this, so someone can be spied upon or maybe literally chopped to pieces?…

Do you have more info on the javascript piece? I cant find docs for those object properties like delegate anywhere

The app has been updated multiple times since, but you can debug Slack and other Electron apps to see the context they are running with. Electron apps merge desktop functionality with web and sometimes it's possible to find abusable functions - e.g. filesystem, leaking dangerous Electron objects etc.

In this case it was possible to abuse lack of context isolation to overwrite functionality (first part of the JS exploit). This changed function behaviour to return (leak) a BrowserWindow class (https://www.electronjs.org/docs/api/browser-window) when calling window.open(). A BrowserWindow class allows to instantiate a new window with your own security settings :)

Some of the current non-standard functions in Slack: https://imgur.com/a/OSjS0kJ

More info: https://www.electronjs.org/docs/tutorial/security

Re: Remote Code Execution in Slack desktop apps

#139

Post by albntomat0 »

jcims wrote: post #126
albntomat0 wrote: post #111

Earlier quoted context omitted.

> Nobody owns you anything, you are doing this mostly for fun. The bounty is just a bonus. That's missing a key point of the bounty system. Slack and its users are better off that this bug was 1: discovered and 2: responsibly reported. The bounty increases the number of eyes looking, but also incentivizes folks to look into weird crashes or fight through the drudgery of triaging odd behavior. The bug value also shows…

> The bug value also shows how much Slack here values their security, and makes me wary of them if I was in the place to be a customer of theirs. Most directly it shows how they value a bug bounty program. There are companies that spend hundreds of millions of dollars per year and have thousands of people in their infosec program that don’t have bug bounty programs. You can extrapolate that to how they value security…

>There are companies that spend hundreds of millions of dollars per year and have thousands of people in their infosec program that don’t have bug bounty programs.

Such as?

Re: Remote Code Execution in Slack desktop apps

#140

Post by tpxl »

panpanna wrote: post #93
Voliokis wrote: post #70

Earlier quoted context omitted.

This might be unpopular, but if you don't feel like the compensation adequately reflects your effort, then you're free to do whatever you think is fair. It's your work. Slack isn't entitled to that work. Ideally, you'd check beforehand what a bug bounty program usually pays out and then decide whether to work on some other company's product that pays better. But you're always going to have people who are interested i…

> whatever you think is fair Please give us some examples of what you would consider fair in this situation.

Hours worked for the exploit * 50$ should be enough.
Post reply on HN