# Eavesdropping on private Slack calls

Slack's screenhero.rooms.invite endpoint lacked authorization checks, letting any team member join a private 1:1 call by replaying an invite request with the victim's room ID.

- Payout: $1,000
- Severity: high
- Program: Slack
- Credited: michiel
- Disclosed: 2017-02-08
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/184698
- Library page: https://bugbountylibrary.com/r/h1%3A184698
- Tags: domain:web impact:data-leak impact:internal-access kind:bounty platform:hackerone sev:high technique:recon vuln:access-control vuln:auth-bypass vuln:idor

**Target:** Slack Calls / screenhero.rooms.invite API endpoint
**Root cause:** The /api/screenhero.rooms.invite endpoint did not verify that the inviter was a participant or had permission to invite into the target room, so any authenticated team member could invite an arbitrary user into any room by supplying its room ID.
**Steps:**
1. Start a call and invite a user, capturing the `POST /api/screenhero.rooms.invite` request with `room`, `responder`, and `token` params.
2. Note the target private call's Screenhero room ID from `https://<team>.slack.com/call/<ROOMID>`.
3. Replay the saved request changing `room` to the victim room ID and `responder` to the eavesdropper's user ID (cannot be self).
4. Forward the request; the eavesdropper account receives a call invite.
5. Accept the call to be placed into the private conversation.
**How found:** Researcher captured a legitimate invite request and hypothesized the endpoint trusted client-supplied `room` and `responder` params without checking inviter authorization, then replayed it against a private call.
**Exploitation:** Attacker with a valid team account and knowledge of the target room ID replays a captured invite request with modified `room` and `responder` params, causing the victim's private call to ring the attacker's account; accepting joins them into the ongoing private call to eavesdrop and participate.
**Escalation:** Attacker can disguise as Slackbot or impersonate a participant by reusing avatar and similar username to avoid detection.
**Insight:** Call/room invite endpoints that take a room ID and target user ID as parameters often skip the check that the caller is a room participant — replay a captured invite with a swapped room ID to test for unauthorized join.