HackerOne #2575 — Slack OAuth Authorization Bypass Token Theft via redirect_uri Manipulation

Source: HackerOne Report #2575

Vulnerability Summary

A critical OAuth authorization bypass vulnerability in Slack allowed attackers to steal OAuth access tokens by manipulating the redirect_uri parameter during the OAuth authorization flow. This is one of the classic OAuth implementation flaws.

Technical Details

The OAuth 2.0 authorization code flow works as follows:

1. The application redirects the user to the authorization server
2. The user authorizes the application
3. The authorization server redirects back to the redirect_uri with an authorization code
4. The application exchanges the code for an access token

The vulnerability existed in step 3: Slack's OAuth implementation did not properly validate that the redirect_uri parameter matched the pre-registered redirect URI for the application. An attacker could:

• Register a legitimate OAuth application with their own redirect URI
• Craft a link that initiates the OAuth flow with a manipulated redirect_uri pointing to the attacker's server
• Intercept the authorization code sent to their server
• Exchange the code for a valid access token

Impact

• Full OAuth token theft: Attackers gain valid access tokens for victim workspaces
• Unauthorized API access: Tokens grant access to Slack APIs based on their scopes
• Data access: Depending on token scopes, attackers can read messages, files, and channel data
• Account takeover: In some configurations, tokens can be used to take over accounts

Why redirect_uri Validation Matters

The redirect_uri parameter is a critical security control in OAuth. Without strict validation:

• Authorization codes can be redirected to attacker-controlled servers
• The OAuth flow's security model is broken — the code is meant to be returned only to the legitimate application
• Any application can steal tokens from any other application

Remediation

Slack fixed the vulnerability by implementing strict redirect_uri validation:

1. The redirect_uri must exactly match the pre-registered URI for the application
2. Partial matches or substring matching are rejected
3. The validation happens server-side, not just client-side

Lessons for OAuth Implementation

• Always validate redirect_uri exactly against the registered value
• Never accept wildcard or partial redirect URIs
• Use state parameters to prevent CSRF in the OAuth flow
• Implement PKCE (Proof Key for Code Exchange) for public clients
• Log and monitor for unusual redirect_uri values