Slack paid a researcher next to nothing for uncovering a critical security bug null
Even large organizations often need help finding vulnerabilities in their software and services which is why many either start their own bug bounty programs or partner with the bug bounty platform HackerOne to do so.
Security researchers expect to be paid for their work and some have even become millionaires for finding critical vulnerabilities that could have serious repercussions for businesses if they were to be exposed online.
However, a security researcher who recently disclosed multiple vulnerabilities to Slack, which could have allowed an attacker to take over a user’s computer, only received $1,750 from the company valued at close to $20bn.
Security engineer Oskars Vegeris from Evolution Gaming privately shared extensive details on the vulnerabilities he discovered in a detailed write-up to Slack back in January of this year. If exploited, these bugs would have allowed an attacker to upload a file and share it with another Slack user or channel to take over a victim’s computer.
Critical vulnerabilities
Vegeris provided further details on the vulnerabilities he discovered in a HackerOne report that was recently made public at his request, saying:
“With any in-app redirect – logic/open redirect, HTML or javascript injection it’s possible to execute arbitrary code within Slack desktop apps. This report demonstrates a specifically crafted exploit consisting of an HTML injection, security control bypass and a RCE Javascript payload. This exploit was tested as working on the latest Slack for desktop (4.2, 4.3.2) versions (Mac/Windows/Linux).”
According to the report, Vegeris showed multiple ways in which Slack apps could be exploited to achieve arbitrary code execution on a user’s computer. He even went as far as to make a Proof-of-Concept (PoC) exploit video show just how easy it would be for a hacker to exploit these bugs if they were left unpatched.
Vegeris himself wasn’t happy for receiving just $1,750 for disclosing multiple bugs and neither was the rest of the security community. However, the payments he received were in line with rewards detailed on Slack’s HackerOne page.
Chief security officer at Slack, Larkin Ryder has since apologized to Vegeris on the company’s HackerOne page after a blog post was published detailing his work without credit, which has since been fixed, saying:
“I am writing to convey very sincere apologies for any oversight in crediting your work. We very much appreciate the time and effort you’ve invested in making Slack safer. While the security team didn’t author this blog post and the author has no visibility to your work in H1, we should make the extra steps to ensure all who contributed to improvement efforts in this area are recognized. I will investigate making appropriate updates to our blog post. Brandon will followup to ensure those updates are to your satisfaction and to coordinate your disclosure request. Again, I am very sorry for any misstep on our part.”
Via BleepingComputer
Even large organizations often need help finding vulnerabilities in their software and services which is why many either start their own bug bounty programs or partner with the bug bounty platform HackerOne to do so. Security researchers expect to be paid for their work and some have even become millionaires…
