PT-2022-5024 · Slack · Slack Morphism

Abdolence · Published 2022-10-10 · Updated 2022-10-11 · CVE-2022-39292

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions Slack Morphism versions prior to 1.3.2

Description The issue is related to the exposure of sensitive information in debug logs. Specifically, debug logs may contain sensitive URLs for Slack webhooks that include private information. This could allow a remote attacker to gain unauthorized access to protected information.

Recommendations For versions prior to 1.3.2, update to version 1.3.2, which redacts sensitive URLs for webhooks. As a temporary workaround, consider disabling or filtering debug logs, especially when using Slack webhooks, by adjusting the tracing log level and filters.

Exploit

Fix

Information Disclosure

Weakness Enumeration

CWE-1258

CWE-200

Related Identifiers

BDU:2022-06237

CVE-2022-39292

GHSA-4MJX-2GH5-PH8H

RUSTSEC-2022-0087

Affected Products

Slack Morphism

References · 14

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/39xxx/CVE-2022-39292.json · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2022-39292 · Security Note
• https://osv.dev/vulnerability/GHSA-4mjx-2gh5-ph8h · Vendor Advisory
• https://bdu.fstec.ru/vul/2022-06237 · Security Note
• https://osv.dev/vulnerability/RUSTSEC-2022-0087 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-39292 · Vendor Advisory
• https://github.com/abdolence/slack-morphism-rust/security/advisories/GHSA-4mjx-2gh5-ph8h · Note
• https://github.com/abdolence/slack-morphism-rust/releases/tag/v1.3.2 · Note
• https://github.com/abdolence/slack-morphism-rust/commit/48a1da2dc2ad3a5ccc60036d43f6f8fbb2c15f1d · Note
• https://github.com/abdolence/slack-morphism-rust · Note
• https://github.com/abdolence/slack-morphism-rust/commit/65ef9fac4f39c4e171e2952a6cf029bb0d059a89 · Note
• https://rustsec.org/advisories/RUSTSEC-2022-0087.html · Note
• https://t.me/cibsecurity/51063 · Telegram Post
• https://crates.io/crates/slack-morphism · Note