PT-2024-24937 · Slack+1 · Slack Bot+1

Laluka · Published 2024-04-26 · Updated 2025-10-29 · CVE-2024-32881

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Danswer versions prior to 3.63

Description Danswer, the AI Assistant connected to a company's documents, applications, and people, is vulnerable to unauthorized access to GET/SET of Slack Bot Tokens. This vulnerability allows anyone with network access to steal and set Slack bot tokens, leading to the full compromise of the customer's Slack bot and internal Slack access.

Recommendations For versions prior to 3.63, update to version 3.63 or later to resolve the issue. As a temporary workaround, consider restricting network access to the Danswer AI Assistant to minimize the risk of exploitation. Additionally, restrict access to the Slack Bot Tokens to prevent unauthorized GET/SET operations.

Exploit

Fix

Improper Authorization

Weakness Enumeration

CWE-285

Related Identifiers

CVE-2024-32881

GHSA-XR9W-3GGR-HR6J

Affected Products

Answer

Slack Bot

References · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/32xxx/CVE-2024-32881.json · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2024-32881 · Security Note
• https://osv.dev/vulnerability/CVE-2024-32881 · Vendor Advisory
• https://github.com/danswer-ai/danswer/security/advisories/GHSA-xr9w-3ggr-hr6j · Note
• https://github.com/danswer-ai/danswer/commit/bd7e21a6388775e850d6f716675a893c72881e56 · Note
• https://github.com/danswer-ai/danswer/commit/89ff07a96b41be9e05256bd252105be233f4d28a · Note
• https://t.me/cvenotify/78214 · Telegram Post
• https://twitter.com/dailycve/status/1983503309987074182 · Twitter Post
• https://twitter.com/aicyberinsights/status/1810443753607586136 · Twitter Post
• https://twitter.com/CVEnew/status/1783967823657681171 · Twitter Post
• https://t.me/cvenotify/78381 · Telegram Post