Adding Custom URLs in slack messages
HackerOne report #1814720 by akadrian
on 2022-12-21, assigned to @fvpotvin:
Report | Attachments | How To Reproduce
Report
Summary
Hi,
This issue is directly related to the following one:
#340176 (closed)
I think that the fix is incomplete. It fixes issue of altering links in first line of Slack Messages but leaves door open to add them later.
Attacker still can create malicious links. Only difference is the position of such link in final message in slack channel. Please let me know if you find that adding any URL to the slack messages is valid issue. I think that the functionality should restrict urls to be either from Gitlab domain itself or custom issue tracker domain so that attacker could not direct other users to his own malicious site.
Steps to reproduce
(Step-by-step guide to reproduce the issue, including:)
1 Create Project called victim-project
2 Create another user called "Attacker" and add him as developer to the victim-project
3 Set up Slack Integration in Gitlab and Toggle "Issue" Trigger
4 Log in as Attacker
5 Click New Issue and set Title field to any value- it can be for example: Very Important Issue
6 Set Description to: <http://customurlhere.com|CLICK HERE>
Impact
Possibility to direct user to malicious site through Slack integration
What is the current bug behavior?
Any custom links can be added to Slack channel using Gitlab integration.
What is the expected correct behavior?
Users should be allowed only to add links to Slack channels that are from gitlab domain or external issue tracker domain so that attacker could not direct other users to malicious links in slack channel.
Impact
Attacker could direct users to malicious sites in slack channel.
Attachments
Warning: Attachments received through HackerOne, please exercise caution!
How To Reproduce
Please add reproducibility information to this section: