# Trick make all fixed open redirect links vulnerable again

Slack's checkcookie open-redirect fix only allowed slack.com hosts, but a public SVG file on files.slack.com with onload JS bypassed it to redirect victims anywhere.

- Payout: $1,000
- Severity: medium
- Program: Slack
- Credited: s1ck-sec
- Disclosed: 2016-05-22
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/104087
- Library page: https://bugbountylibrary.com/r/h1%3A104087
- Tags: domain:web impact:integrity kind:bounty platform:hackerone sev:medium tech:rest technique:chained technique:incomplete-fix vuln:open-redirect vuln:xss

**Target:** slack.com/checkcookie redir parameter + files.slack.com SVG hosting
**Root cause:** The redirect allowlist validated the redir host as slack.com, but files.slack.com serves attacker-uploaded SVG with inline JavaScript that executes on navigation, turning an allowed same-domain URL into an arbitrary redirect.
**Steps:**
1. Upload an SVG containing `<svg onload="window.location='http://www.example.com'" xmlns="http://www.w3.org/2000/svg"></svg>` to Slack
2. Create a public link: `https://files.slack.com/files-pri/T0E7QLVLL-F0G41EG2W/redirect.svg?pub_secret=7a6caed489`
3. Build `https://slack.com/checkcookie?redir=https://files.slack.com/files-pri/T0E7QLVLL-F0G41EG2W/redirect.svg?pub_secret=7a6caed489`
4. Victim clicks; checkcookie allows the slack.com host, loads the SVG, onload JS redirects to http://www.example.com
**How found:** Researcher reviewed the prior fixed report (2622) and reasoned the fix only restricted the redir host to slack.com; they looked for any slack.com-hosted content they could control that executes script, finding user-uploaded SVG files served inline.
**Exploitation:** Attacker uploads a malicious SVG, makes it public, and wraps the files.slack.com URL in the checkcookie redir parameter. Because the host is slack.com the allowlist passes, and the SVG's onload script executes in the browser to redirect the victim to an arbitrary attacker site.
**Insight:** When a redirect allowlist is host-based, hunt for any user-controlled content on an allowed host that executes script (SVG, HTML, XML) and use it as the redirect target to re-open the bug.