Invitation reminder emails contain insecure links
Low
S
Slack
Submitted None
Actions:
Reported by
hanno
Vulnerability Details
Technical details and impact analysis
If one gets invited to a slack channel and does not act upon the invitation a while later a reminder email is sent.
The links in these reminders are http links. Excerpt from the mail:
----------------------
Don’t miss out — come join the conversation!
Join Now
http://click.email.slack-core.com/?qs=[id removed]
----------------------
This poses an unnecessary risk that the connections can be intercepted and redirected by an attacker.
This is particularly surprising and unnecessary as:
1. The links directly redirect to an https URL.
2. The initial invitation mail contains no such indirect link, it directly links to https.
## Impact
Attackers that are in the same network as a person receiving an invitation reminder mail can do a man in the middle attack and redirect the victim to a forget fake slack webpage.
Report Details
Additional information and metadata
State
Closed
Substate
Resolved
Bounty
$350.00
Submitted
Weakness
Cryptographic Issues - Generic