Slack < 4.4.0 Remote Code Execution (Deprecated)

critical Nessus Plugin ID 140214

Language:

Synopsis

This plugin has been deprecated.

Description

This plugin has been deprecated due to server side fixes.

The version of the Slack Desktop installed on the remote host is prior to 4.4.0. It is, therefore, affected by a Remote Code Execution vulnerability. With any in-app redirect - logic/open redirect, HTML or javascript injection, it is possible to execute arbitrary code within Slack desktop apps.

Note that Nessus has not tested for these issues but has instead relied only on the application's reported version number.

Plugin Details

Severity: Critical

ID: 140214

File Name: slack_4_4_0.nasl

Version: 1.4

Type: local

Agent: windows, macosx, unix

Family: Misc.

Published: 9/4/2020

Updated: 1/20/2022

Supported Sensors: Nessus Agent, Nessus

Risk Information

CVSS Score Rationale: Score based on a remote code execution vulnerability.

CVSS v2

Risk Factor: Critical

Base Score: 10

Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C

CVSS Score Source: manual

CVSS v3

Risk Factor: Critical

Base Score: 9.8

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Vulnerability Information

CPE: x-cpe:/a:slack:slack

Patch Publication Date: 3/18/2020

Vulnerability Publication Date: 8/28/2020

Reference Information

IAVB: 2020-B-0058-S

Detections

Analytics