# Stored XSS on team.slack.com using new Markdown editor of posts inside the Editing mode and using javascript-URIs

Stored XSS in Slack post edit mode: a tampered WebSocket payload injects a javascript: URI into post links, executing on click for editors.

- Payout: hidden
- Severity: high
- Program: Slack
- Found by: fransrosen
- Disclosed: 2016-09-01
- Write-up quality: 7/10
- Original: https://hackerone.com/reports/132104
- Library page: https://bugbountylibrary.com/r/h1%3A132104
- Tags: area:web domain:web impact:integrity kind:bounty platform:hackerone sev:high tech:websocket technique:source-review vuln:xss

**Target:** team.slack.com post Markdown editor / WebSocket 'rocket' event
**Root cause:** The post editor's WebSocket 'rocket' event accepts a client-supplied links map without validating URI schemes, and the edit-mode renderer lacks the http(s)-only link guard present on slack-files.com previews.
**Steps:**
1. Open a post in edit mode on team.slack.com and delete a link, then Ctrl+Z to restore it.
2. Capture the resulting WebSocket 'rocket' event.
3. Modify the payload's `links` map to `{"javascript:alert(\"XSS\")":[0,22]}` and set `url` to `javascript:alert("XSS")`.
4. Replay the modified WebSocket frame; the link is stored with the javascript: scheme.
5. Click the link in edit mode to trigger `alert(document.domain)`.
**How found:** Noticed old posts contained javascript: links; experimenting with edits revealed edit mode lacked the scheme check that slack-files.com previews enforce, then tampered with the WebSocket frame to inject the payload.
**Exploitation:** Attacker with edit rights (or via 'Let others edit this Post') injects a javascript: URI into a post's link metadata over the WebSocket; any team member who opens the post in edit mode and clicks the link executes attacker JS in the team.slack.com origin.
**Escalation:** Enabling 'Let others edit this Post' extends the payload to other team members who edit the post.
**Insight:** Compare client-side sanitization between render contexts (public preview vs. in-app editor) of the same content; the editor's WebSocket mutation path may skip the guard applied on the public host.