Executing scripts on slack-files.com using SVG
该报告还没有中文解读。
原文摘录
摘自原文（2197 字符中的一小部分）
Although `slack-files.com` is a sandbox domain, there are many ways to gain the victim's trust during phishing attack. For example, an attacker might render a fake log-in form with "You need to sign in to see this file" message and trick users into handing out their passwords.
原文中的代码
<svg width="100%" height="100%" viewBox="0 0 100 100" xmlns="http://www.w3.org/2000/svg" onload="alert('script')">
<script type="text/javascript"><![CDATA[
// some exploit code here
]]></script>
<circle cx="50" cy="50" r="50" fill="green" />
</svg>默认不展示报告全文。以上为简短摘录，完整复现过程请阅读原文。版权归研究员与 Slack 所有。
时间线
- 报告提交
- 公开披露
阅读 HackerOne 原文 ↗作者 @kamil_hism · 版权归作者与 Slack 所有