Tenable research discovers download hijack vulnerability in Slack

In Research

Tenable Inc, the Cyber Exposure company, announced that its research team has discovered a vulnerability in the Slack Desktop Application for Windows that could have allowed an attacker to alter where a victim’s files are stored when the documents are downloaded within Slack.

Slack has become a critical tool for many organizations looking to keep their employees connected. The vulnerability, which was found in Slack Desktop Application for Windows version 3.3.7 and has since been patched in version 3.4.0, could have allowed an attacker to send a crafted hyperlink via a Slack message that, once clicked, changes the document download location path to an attacker-owned file share. By exploiting the flaw, an attacker can not only steal future documents downloaded within Slack, but they can also manipulate them, such as injecting malicious code that would compromise the victim’s machine once opened.

“The digital economy and global distributed workforce have brought new technologies to market with the ultimate goal of seamless connectivity,” said Renaud Deraison, co-founder and chief technology officer, Tenable. “But it’s critical that organizations realize this emerging technology is potentially vulnerable and part of their expanding attack surface. Tenable Research continues to work with vendors such as Slack to disclose our discoveries to ensure consumers and organizations are secure.”

Slack has released version 3.4.0 to address this vulnerability. Users are urged to confirm that their Slack for Windows is updated to this latest version.

Comments

You may also read!

Dhrupad Trivedi joins A10 Networks as the new CEO

A10 Networks announced that Dhrupad Trivedi has joined the company as its new President and Chief Executive Officer. Lee

Read More...

Qualys launches new Vulnerability Management, Detection and Response app 

Qualys, announced its new Vulnerability Management, Detection and Response (VMDR) app to provide customers with one streamlined workflow to scan, investigate, prioritize and neutralize threats. Comments

Read More...

Threats from 5G connectivity

Trend Micro’s latest research explored the threats to 5G connectivity from SIM jacking, identity fraud, fake news, and poisoning

Read More...

Join Our Newsletter!

Love SecurityMEA? We love to tell you about our new stuff. Subscribe to newsletter!

Mobile Sliding Menu