# Facebook Takeover using Slack using 302 from files.slack.com with access_token

Slack's Facebook OAuth app accepted files.slack.com as redirect_uri; a 302 there leaks the access_token in the fragment, enabling Facebook account takeover.

- Payout: hidden
- Severity: high
- Program: Slack
- Found by: fransrosen
- Disclosed: 2015-01-11
- Write-up quality: 7/10
- Original: https://hackerone.com/reports/6017
- Library page: https://bugbountylibrary.com/r/h1%3A6017
- Tags: area:web domain:web impact:ato kind:bounty platform:hackerone sev:high tech:oauth technique:chained vuln:auth-bypass vuln:open-redirect

**Target:** Facebook OAuth dialog via Slack's Import Photo app
**Root cause:** Slack's Facebook OAuth app allowed any *.slack.com subdomain as redirect_uri, and files.slack.com issues a 302 that preserves the URL fragment containing the access_token.
**Steps:**
1. Craft `https://www.facebook.com/dialog/oauth?client_id=569627156411038&redirect_uri=https%3A%2F%2Ffiles.slack.com%2Ffiles-pri%2FT025M9QPZ-F0283NJ20%2Fhash.swf&response_type=token&scope=user_photos&sdk=joey`
2. Victim authenticates/approves the app (or already has it approved, no interaction needed)
3. Facebook redirects to files.slack.com with `#access_token=...` in fragment
4. files.slack.com returns 302 preserving the fragment, leaking the token to the attacker-controlled destination
**How found:** Noticed the Import Photo Facebook app and that a 302 from *.slack.com preserves hash values, then checked whether files.slack.com was accepted as redirect_uri.
**Exploitation:** Attacker sends the crafted OAuth URL to a victim; after approval the token in the fragment follows the 302 off files.slack.com, giving the attacker the victim's Facebook access_token for account takeover.
**Escalation:** Chaining weak OAuth redirect_uri allowlist with an open redirect on files.slack.com to exfiltrate the token fragment.
**Insight:** OAuth implicit-flow tokens live in the URL fragment; any subdomain that 302s (even to itself) can carry the fragment onward, so wildcard subdomain allowlists plus redirectors leak tokens.