Slack Morphism is an async client library for Rust. Prior to 0.41.0, it was possible for Slack OAuth client information to leak in application debug logs. Stricter and more secure debug formatting was introduced in v0.41.0 for OAuth secret types to reduce the possibility of printing sensitive information in application logs. As a workaround, do not print/output requests and responses for OAuth and client configurations in logs.

Threat-Mapped Scoring

Score: 3.0

Priority: P2 - Serious (High)

• S1 – Steal Customer Account Information

EPSS

Score: 0.00371
Percentile: 0.58099

CVSS Scoring

Mapped CWE(s)

• CWE-1258 : Exposure of Sensitive System Information Due to Uncleared Debug Information
• CWE-200 : Exposure of Sensitive Information to an Unauthorized Actor
• CWE-212 : Improper Removal of Sensitive Information Before Storage or Transfer

All CAPEC(s)

CAPEC(s) with Mapped TTPs

Mapped ATT&CK TTPs

• T1562.003 : Impair Command History Logging
  Kill Chain: defense-evasion
• T1574.006 : Dynamic Linker Hijacking
  Kill Chain: persistence
• T1574.007 : Path Interception by PATH Environment Variable
  Kill Chain: persistence
• T1003 : OS Credential Dumping
  Kill Chain: credential-access
• T1119 : Automated Collection
  Kill Chain: collection
• T1213 : Data from Information Repositories
  Kill Chain: collection
• T1530 : Data from Cloud Storage
  Kill Chain: collection
• T1555 : Credentials from Password Stores
  Kill Chain: credential-access
• T1602 : Data from Configuration Repository
  Kill Chain: collection
• T1217 : Browser Information Discovery
  Kill Chain: discovery
• T1592 : Gather Victim Host Information
  Kill Chain: reconnaissance
• T1595 : Active Scanning
  Kill Chain: reconnaissance
• T1005 : Data from Local System
  Kill Chain: collection
• T1018 : Remote System Discovery
  Kill Chain: discovery
• T1124 : System Time Discovery
  Kill Chain: discovery
• T1046 : Network Service Discovery
  Kill Chain: discovery
• T1016 : System Network Configuration Discovery
  Kill Chain: discovery
• T1049 : System Network Connections Discovery
  Kill Chain: discovery
• T1590 : Gather Victim Network Information
  Kill Chain: reconnaissance
• T1082 : System Information Discovery
  Kill Chain: discovery
• T1082 : System Information Discovery
  Kill Chain: discovery
• T1005 : Data from Local System
  Kill Chain: collection
• T1552.004 : Private Keys
  Kill Chain: credential-access
• T1083 : File and Directory Discovery
  Kill Chain: discovery
• T1005 : Data from Local System
  Kill Chain: collection
• T1555.001 : Keychain
  Kill Chain: credential-access
• T1057 : Process Discovery
  Kill Chain: discovery
• T1007 : System Service Discovery
  Kill Chain: discovery
• T1087 : Account Discovery
  Kill Chain: discovery
• T1069 : Permission Groups Discovery
  Kill Chain: discovery
• T1615 : Group Policy Discovery
  Kill Chain: discovery
• T1033 : System Owner/User Discovery
  Kill Chain: discovery
• T1134.001 : Token Impersonation/Theft
  Kill Chain: defense-evasion
• T1550.004 : Web Session Cookie
  Kill Chain: defense-evasion
• T1036.005 : Match Legitimate Resource Name or Location
  Kill Chain: defense-evasion
• T1135 : Network Share Discovery
  Kill Chain: discovery
• T1120 : Peripheral Device Discovery
  Kill Chain: discovery
• T1111 : Multi-Factor Authentication Interception
  Kill Chain: credential-access

Malware

APTs Threat Group Associations

Campaigns

Affected Products

• cpe:2.3:a:slack_morphism_project:slack_morphism:*:*:*:*:*:rust:*:*

← Back to Home