# Code Injection in Slack's Windows Desktop Client leads to Privilege Escalation

Slack's Windows client loads OpenSSL config from C:\usr\local\ssl\openssl.cnf, which any local user can create to inject code into other users' Slack processes.

- Payout: hidden
- Severity: high
- Program: Slack
- Found by: fbogner
- Disclosed: 2017-07-14
- Write-up quality: 7/10
- Original: https://hackerone.com/reports/162955
- Library page: https://bugbountylibrary.com/r/h1%3A162955
- Tags: area:os domain:desktop impact:privesc impact:rce kind:bounty platform:hackerone sev:high tech:windows technique:recon vuln:command-injection vuln:privilege-escalation

**Target:** Windows desktop client (slack.exe) OpenSSL config loading
**Root cause:** slack.exe loads its OpenSSL configuration from a non-existent path C:\usr\local\ssl\openssl.cnf at the system drive root, a location any authenticated user can create. The attacker-controlled config can instruct OpenSSL to load additional libraries.
**Steps:**
1. Observe via Procmon that slack.exe attempts to load `C:\usr\local\ssl\openssl.cnf`
2. As any local user, create the folder structure `C:\usr\local\ssl\`
3. Place a crafted `openssl.cnf` that instructs OpenSSL to load an attacker-supplied library
4. Wait for another user to log in; Slack auto-starts and loads the config, executing attacker code in that user's slack.exe process
**How found:** Used Procmon to trace file access by slack.exe and noticed it probing a non-existent OpenSSL config path at the drive root, then reasoned that the root is user-writable.
**Exploitation:** Any authenticated local user creates the missing directory tree and a malicious openssl.cnf pointing OpenSSL at an attacker DLL. Because Slack auto-starts at login, the victim's slack.exe loads the config and executes the payload in the victim's context, yielding code execution/privilege escalation across users.
**Escalation:** Cross-user escalation: low-privileged local user gains code execution in other users' Slack processes, including higher-privileged accounts, aided by Slack's auto-start at login.
**Insight:** Trace a Windows app's file loads with Procmon and look for config/library paths under drive-root or other user-writable locations; OpenSSL cnf files can load arbitrary engines/libraries, turning a writable config path into code execution.