Loading HuntDB...

Invitation reminder emails contain insecure links

Low
S
Slack
Submitted None
Reported by hanno

Vulnerability Details

Technical details and impact analysis

Cryptographic Issues - Generic
If one gets invited to a slack channel and does not act upon the invitation a while later a reminder email is sent. The links in these reminders are http links. Excerpt from the mail: ---------------------- Don’t miss out — come join the conversation! Join Now http://click.email.slack-core.com/?qs=[id removed] ---------------------- This poses an unnecessary risk that the connections can be intercepted and redirected by an attacker. This is particularly surprising and unnecessary as: 1. The links directly redirect to an https URL. 2. The initial invitation mail contains no such indirect link, it directly links to https. ## Impact Attackers that are in the same network as a person receiving an invitation reminder mail can do a man in the middle attack and redirect the victim to a forget fake slack webpage.

Report Details

Additional information and metadata

State

Closed

Substate

Resolved

Bounty

$350.00

Submitted

Weakness

Cryptographic Issues - Generic