Exposed incoming webhooks allow threat actors to post unauthorized and potentially malicious messages into Slack channels.A plethora of Slack Webhook URLs can be found across open sources on the internet alone, with a majority of them containing sensitive and uncensored webhook values.Slack webhooks should not be overlooked while securing the application endpoints as they can be exploited in the following ways: How Threat Actors Exploit Slack Webhooks? Slack actively searches for and revokes leaked URLs.Webhooks only deliver data, and thus cannot be used to extract sensitive information on its own.The generated URLs are unique and confidential.Webhooks are made for a targeted Slack Channel, thus reducing the scope of the breach.Slack webhooks are often considered low-risk integrations because of the following reasons:

Threat actors can leverage these to launch phishing attacks on users of the Slack application. Incoming webhooks are a simple way to post messages from third-party apps into Slack.CloudSEK’s Customer Threat Research team analyzed the findings from BeVigil and discovered multiple Slack webhooks in the said application.Screenshot of BeVigil dashboard showing the leaked Slack webhooks The generated URL contains sensitive information which if leaked, could compromise the Slack Channel and the information shared through them. Incoming Slack webhooks allow their users to post messages from external applications into selected Slack Channels.Ĭreating an incoming webhook on Slack generates a unique URL through which a JSON payload with a text message is sent to the intended Slack Channel.

A webhook is a lightweight API used for one-way communication between different applications. Continuous monitoring of Slack OAuth applications.ĬloudSEK’s flagship application scanning platform BeVigil has detected leaked Slack webhooks in one of the applications being monitored.Apply the least privilege policy on Slack webhooks.Restrict the webhooks from Slack channels.Leaked Slack webhooks allow threat actors to send unauthorized and potentially malicious messages on Slack.Exposed webhooks can be leveraged to access sensitive data and also propagate phishing messages.

An application was recently found vulnerable due to the leaked Slack webhooks in its assets.

Incoming webhook slack