# Slack integration setup lacks CSRF protection

HackerOne's Slack OAuth integration flow lacked CSRF protection at initiation, letting an attacker who controls the third-party OAuth flow bind their own Slack account to a victim's HackerOne team.

- Payout: $2,500
- Severity: high
- Program: HackerOne
- Found by: whhackersbr
- Disclosed: 2021-07-07
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/170552
- Library page: https://bugbountylibrary.com/r/h1%3A170552
- Tags: area:web domain:web impact:integrity kind:bounty platform:hackerone sev:high tech:oauth technique:source-review vuln:csrf

**Target:** OAuth integration endpoint /auth/slack on hackerone.com
**Root cause:** The OAuth flow initiation at /auth/slack has no CSRF token tying the request to the victim's session; the state parameter is generated but the flow trusts third-party (Slack) security, so an attacker controlling the third-party flow can complete the OAuth binding.
**Steps:**
1. Attacker obtains an XSS, Login CSRF, or Clickjacking in the third-party (Slack) system to control the OAuth flow.
2. Victim is driven through `GET https://hackerone.com/auth/slack`, which redirects to `https://slack.com/oauth/authorize?client_id=...&redirect_uri=https%3A%2F%2Fhackerone.com%2Fauth%2Fslack%2Fcallback&response_type=code&scope=incoming-webhook&state=...`.
3. Attacker, controlling the third-party flow, completes authorization with the attacker's own Slack account and the callback binds it to the victim's HackerOne team.
4. Attacker's Slack account is now connected to the victim's HackerOne account.
**How found:** Researcher reviewed the Integrations OAuth flow, noticed the state parameter alone was relied upon, and reasoned that trust in third-party security is not under HackerOne's control.
**Exploitation:** Requires a precondition vulnerability (XSS, Login CSRF, or Clickjacking) in the third-party OAuth provider; with that, the attacker controls the entire OAuth flow and connects their own accounts to the victim's HackerOne account.
**Escalation:** Report notes that adding more integrations, especially Login with Facebook/Google, would escalate this to account takeover.
**Insight:** When auditing OAuth integrations, check whether CSRF protection exists at flow initiation independent of the provider's state parameter; a confirmation dialog after OAuth completion (Phabricator-style) mitigates provider-side compromise.

## Proof of concept (copied exactly from the original report)

**GET request initiating Slack OAuth flow**

```
GET https://hackerone.com/auth/slack HTTP/1.1
```

**OAuth authorize redirect with state parameter**

```
Location: https://slack.com/oauth/authorize
?client_id=2174110321.11522100978
&redirect_uri=https%3A%2F%2Fhackerone.com%2Fauth%2Fslack%2Fcallback
&response_type=code
&scope=incoming-webhook
&state=379fd8f1baa8d80516e2f706f025057ad0ce2cca0bbbd56c
```