Remote Code Execution in Slack desktop apps
I wrote that exploit & report. Just some thoughts on comments here.<p>Sure the bounty is low, but ultimately it's their money and their decision. They will deal with the 'consequences' of others skipping their program and some public shaming.<p>I find everyone talking about black markets etc. kind of ridiculous. Really? You would sell something like this, so someone can be spied upon or maybe literally chopped to pieces? Jesus, not everything is about money - it was a fun challenge to chain it all together and I learned a lot from it.<p>The most outrageous part for me was the blog post I discovered by accident - it included no references or mentions (check archive.org). Both of the code snippets there are from my RCE reports. At the same time they were denying my requests for disclosure.<p>Of course, I understand that coordination mistakes like this happen, so I accept their apology and move on!<p>Evidence - original RCE video with huge CSS injection overlay: <a href="https://www.dropbox.com/s/11pv2ghdkw5g84b/css-rce-overlay.mov?dl=0" rel="nofollow">https://www.dropbox.com/s/11pv2ghdkw5g84b/css-rce-overlay.mo...</a>