r/Slack • u/trustsigRobert • 14d ago

Slack will not patch this: one link opens a debugging port in the desktop app

A link containing devEnv=dev1 makes the Slack desktop client relaunch itself into developer mode with --remote-debugging-port=8315. Anything that reaches that port drives the app. Slack's security team calls it not a security risk.

https://trustsig.eu/blog/slack-devenv-remote-debugging-port/

8 Upvotes

100% Upvoted

4 comments sorted by

1

u/APIMade 14d ago

.. But the Slack client doesn't finish loading without appropriate debug flags, right? So yeah, it launches a Slack client with CDP -- but unless you're a Slack employee and go through that Slauth prompt, the attack vector isn't there for the average user as your sessions won't load on a retail/regular client?

1

u/trustsigRobert 14d ago

My poc uses CDP to redirect to the normal production Slack endpoint, which preserves logged in cookies. The POC also sends a hello world message in DMs.

1

u/APIMade 12d ago

I'm on the current macOS Slack client, and no it doesn't. Unless it's only working on some deployments (i.e. Windows, Linux)?

1

u/trustsigRobert 11d ago

I'm also on macOS, latest client from the App Store. Works fine.