,
10 tweets,
4 min read
Read on Twitter
1/ THREAD: I'm stuck in my current task and it's raining outside. I need to kill some time so I'll publish 3 0days in this thread
2/ The @WordPress plugin called WP Intercom - Slack for WordPress allow you to chat to your customer from @Slack codecanyon.net/item/wp-interc…
3/ If you use this plugin in your website, your "Slack Access Token" will be accessible in your source code... Oops 
4/ With this token an attacker can use the @Slack API:
- Post chat messages to Slack.
- Get info on your team's Slack channels
- Create or archive channels, invite users
- Set the topic and purpose
api.slack.com/methods
- Post chat messages to Slack.
- Get info on your team's Slack channels
- Create or archive channels, invite users
- Set the topic and purpose
api.slack.com/methods
5/ You can test if a token if valid with the test endpoint
6/ An old version of the WP SlackSync wordpress plugin was vulnerable to the same issue wpslacksync.com
7/ Finally, the SlackChat plugin was vulnerable to the same issue arjunmat.github.io/slack-chat/
8/ The Slack token was accessible in the source code too.
9/ Because I'm not entirely stupid (am I?) I tried to disclose this issue responsibly. Only the creator of the "WP SlackSync Plugin" answered me and did the needful to his clients
10/ Conclusion: Be cautious when you install a Wordpress plugin!
