Action does not validate that the `SLACK_WEBHOOK_URL` is a valid Slack webhook URL

Open Beginner friendly
#621 1 comment 1 reaction 0 assignees View on GitHub

Nobody has claimed this yet.

Assessment

Difficulty
2/5
Estimated time
1-3 hours
Newbie friendliness
72/100
Issue type
Bug
Clarity
Clearly specified
Activity status
Quiet
Tech stack
github-actions, javascript
Domain
devops, security

Research direction

Start in src/config.js at the SLACK_WEBHOOK_URL handling and follow the value into src/webhook.js, where the request is sent. Confirm the action rejects URLs unless they use the https://hooks.slack.com/* format, while preserving valid webhook behavior; verify this with the repository's existing checks.

Written by the indexing model from the issue text.

Description

discussion security semver:major

The GitHub action does not validate that the passed Slack webhook URL is a valid Slack webhook URL. Thus, an attacker can pass URLs that do not have the format https://hooks.slack.com/*.

If an attacker attacks a GitHub workflow which uses the Slack GitHub action and manages to set the SLACK_WEBHOOK_URL environment variable, they can make the Slack GitHub action send requests to any arbitrary URL (incl. servers on internal networks, or ports on the same machine). That's classic SSRF.

The Slack GitHub action should validate that the passed webhook URL is a valid webhook URL, i.e., has the format https://hooks.slack.com/*.

This is where the environment variable is being read: https://github.com/slackapi/slack-github-action/blob/9a2e0ee8deeff80fa9eb79bec773084babe367a5/src/config.js#L121

This is where the request is being sent, with no validation of the webhook URL: https://github.com/slackapi/slack-github-action/blob/9a2e0ee8deeff80fa9eb79bec773084babe367a5/src/webhook.js#L26

I tried reporting this vulnerability responsibly through Slack's HackerOne program, but was told that this was not a security vulnerability. I still believe it should be fixed. Hence, this GitHub issue.

As an aside, similar attacks might (or might not) be possible for the API URL or the HTTPS proxy (I haven't had time to look into those): https://github.com/slackapi/slack-github-action/blob/9a2e0ee8deeff80fa9eb79bec773084babe367a5/src/config.js#L106-L117

Dominant language
JavaScript
Stars
1.3k
Forks
200
Avg merge
2h 59m
Merged PRs (30d)
6

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from slackapi/slack-github-action

All issues in slackapi/slack-github-action

Similar issues

More JavaScript issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.