Slack, an internal messaging and communication application for organizations/businesses, is vulnerable to a security vulnerability that exposes user credentials.
The vulnerability was detected in Slack’s “Shared Invite Link” component. The “Shared Invite Link” functionality allows workspace administrators to create links to include other participants in the workspace. With this feature, the personnel of the institution/organization are invited to become workspace members via e-mail. The detected security vulnerability causes the hash values of Slack passwords to be transmitted to other workspace members when a user creates an invitation link. These password hashes do not appear in any Slack client. Accessing password hashes requires active monitoring of encrypted network traffic from Slack’s servers.
The vulnerability affects all users who created or canceled an invite link between April 17, 2017, and July 17, 2022. Slack officials have announced that as a precaution against the potential risk of a data breach, affected users have reset their Slack passwords. Slack users must set a new Slack password to log in again.
In this context, it is recommended to create new passwords by applying strong and unique policies, to enable MFA/2FA authentication controls on all possible platforms as a precaution against similar security vulnerabilities that may cause data breaches, and to ensure that the applications/programs and systems being used are always up to date.
What does Slack’s own notice say?
In its notice about password resets, dated 4 August 2022, Slack says the bug appeared when users created or revoked a Shared Invite Link for their workspace. Slack sent a hashed version of the password to other members of that workspace. An independent security researcher found the bug and reported it to Slack on 17 July 2022, and Slack fixed it right after the report. Slack says about 0.5% of its users were affected.
Slack also says it has “no reason to believe that anyone was able to obtain plaintext passwords”. The exposed value was a salted hash, not the password itself, and it did not show up in any Slack client. To use it, an attacker would have had to watch encrypted network traffic coming from Slack’s servers.
How can users check their accounts?
Slack points users to their personal access logs at my.slack.com/account/logs, where a CSV export is also available. Owners and admins on paid plans can see the workspace access logs through the Slack Help Centre. Slack’s own advice matches the advice above: turn on two-factor authentication, use a unique password for each service, use a password manager, and keep computers and antivirus software up to date.