PT-2022-20577 · Slack · Slack Morphism

Abdolence · Published 2022-07-20 · Updated 2023-07-24 · CVE-2022-31162

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Slack Morphism versions prior to 0.41.0

Description The issue concerns the potential leakage of Slack OAuth client information into application debug logs due to insecure debug log formatting. This could lead to the accidental exposure of sensitive information. The estimated number of potentially affected devices worldwide is not specified. There is no information about real-world incidents where this issue was exploited.

Recommendations For versions prior to 0.41.0, update to version 0.41.0 or later to introduce stricter and more secure debug formatting for OAuth secret types. As a temporary workaround, do not print/output requests and responses for OAuth and client configurations in logs.

Exploit

Fix

Information Disclosure

Weakness Enumeration

CWE-1258

CWE-200

CWE-212

Related Identifiers

CVE-2022-31162

GHSA-99J7-MHFH-W84P

RUSTSEC-2022-0086

Affected Products

Slack Morphism

References · 12

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/31xxx/CVE-2022-31162.json · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2022-31162 · Security Note
• https://osv.dev/vulnerability/RUSTSEC-2022-0086 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-99j7-mhfh-w84p · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-31162 · Vendor Advisory
• https://github.com/abdolence/slack-morphism-rust/pull/133 · Note
• https://github.com/abdolence/slack-morphism-rust/commit/4923fb7d458ed28c0302244c54cb4df0acee7ee6 · Note
• https://github.com/abdolence/slack-morphism-rust/releases/tag/v0.41.0 · Note
• https://github.com/abdolence/slack-morphism-rust · Note
• https://github.com/abdolence/slack-morphism-rust/security/advisories/GHSA-99j7-mhfh-w84p · Note
• https://rustsec.org/advisories/RUSTSEC-2022-0086.html · Note
• https://crates.io/crates/slack-morphism · Note