Not exactly ‘smoking gun’ time but…:
[…] Slack webhooks are perceived as a low-risk integration because it’s assumed the webhook configuration requires selecting a target channel to share a message, which would limit the scope of abuse to a single channel. It’s also assumed the unique webhook URL is a secret and that the webhook only accepts data – and therefore couldn’t expose sensitive data on its own.
“A deeper dive into webhooks shows that this is not entirely accurate,” writes Ashley Graves, senior security researcher with AlienLabs at AT&T Cybersecurity, in a blog post on her research. Back in January, Graves had been working on a Slack application with webhooks when she realized they didn’t work as she expected. This inspired her to take a deeper dive into the tool.
It’s important to note Graves did not find a vulnerability in Slack itself; however, she did find subtle ways that attackers could abuse features in the platform to target unsuspecting users.
For starters, she explains, attackers could override the webhook target channel by adding the “channel” key to their JSON payload. If they gain access to a webhook for one channel, Graves says, they can use the same webhook in others. This may prompt them to send a webhook to #general, #engineering, or another Slack channel likely to have a larger group of people in it. In some cases, this move could override a channel’s posting permissions like admin-only posting.
Webhook URLs are considered secret; however, researchers found 130,989 public code results on GitHub containing these URLs. Most of them held the full unique webhook value, she notes.
There are a few reasons why an attacker would want to take advantage of Slack, which Graves points out “is used by a lot of enterprises.” Discussions could contain a company’s intellectual property, while uploaded files may hold confidential data. “A lot of sensitive discussions go on in Slack and there’s the assumption only employees have knowledge of that,” she explains in her post. With OAuth, someone could retrieve files and conversations, or send Slack messages of their own.