Workplace productivity software giant Slack on Friday forced password resets for a tiny fraction of its users after the discovery of a security flaw that exposed Slack credentials.
Slack’s security response team alerted users to the issue via email and followed up with a blog post warning about the risk of passwords leaking to a skilled attacker.
“We have no reason to believe that anyone was able to obtain your plaintext password because of this vulnerability. However, for the sake of caution, we have reset your Slack password,” the company told a fraction of its users.
According to official Slack documentation, the bug was discovered and fixed in Slack’s Shared Invite Link functionality, a feature that lets Slack workspace owners create a link that will permit anyone to join. The feature is offered as an alternative to inviting people one-by-one via email to become workspace members.
[ READ: Slack Offers Bigger Rewards for Serious Vulnerabilities ]
However, for users who created and/or revoked one of these links – Slack estimates it affects approximately 0.5% of users – between April 17, 2017 and July 17, 2022, Slack exposed a hashed password over the websocket to all users of the workspace who were currently connected to Slack.
From the Slack advisory:
“This hashed password was not visible in any Slack clients; discovering it required actively monitoring encrypted network traffic coming from Slack’s servers. This bug was discovered by an independent security researcher and disclosed to us on July 17, 2022.
Upon receiving the report from the security researcher, we immediately fixed the underlying bug, and then began investigating the potential impact of this issue on our customers. We have no reason to believe that anyone was able to obtain plaintext passwords because of this issue. However, for the sake of caution, we have reset affected users’ Slack passwords.”
Slack is also using the incident to recommend that all users use multi-factor authentication technology and to ensure computer software and anti-malware security tools are updated.
The Salesforce-owned company is also recommending the use of new, unique passwords for every service and a password manager to help users avoid password reuse.
Related: New Slack Connect DM Feature Raises Security Concerns
Related: Slack Offers Bigger Rewards for Serious Vulnerabilities
Related: Iran-Linked APT Abuses Slack in Attacks on Asian Airline
