Tenable Research Discovered a Download Hijack Vulnerability in Slack

Tenable®, Inc., the Cyber Exposure company, today announced that its research team discovered a vulnerability in the Slack Desktop Application for Windows that could have allowed an attacker to alter where a victim’s files are stored when the documents are downloaded within Slack.

Slack has become a critical tool for many organizations looking to keep their employees connected.

The vulnerability, which was found in Slack Desktop Application for Windows version 3.3.7 and has since been patched in version 3.4.0, could have allowed an attacker to send a crafted hyperlink via a Slack message that, once clicked, changes the document download location path to an attacker-owned file share. By exploiting the flaw, an attacker can not only steal future documents downloaded within Slack, but they can also manipulate them, such as injecting malicious code that would compromise the victim’s machine once opened.

Tenable PR Here

[optin-monster-shortcode id=”dv4jqlr9fih8giagcylw”]

John Evans

Customer Success Manager John has over 15 years’ experience in managing clients and helping them achieve their desired outcomes. John heads up our customer success and community management at IndustrialCyber, taking care of clients’ needs, inquiries and advertising.