Miggo Logo
Miggo Vulnerability Database
→
CVE-2022-39292

CVE-2022-39292: Exposure of sensitive Slack webhook URLs in debug logs and traces

7.5

CVSS Score
3.1

Basic Information

CVE ID
CVE-2022-39292
GHSA ID
GHSA-4mjx-2gh5-ph8h
EPSS Score
0.3121%
CWE
CWE-1258
Published
10/10/2022
Updated
2/2/2023
KEV Status
No
Technology
TechnologyRust

Technical Details

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Package NameEcosystemVulnerable VersionsFirst Patched Version
slack-morphismrust< 1.3.21.3.2

Vulnerability Intelligence
Miggo AIMiggo AI

Miggo AIRoot Cause Analysis

The vulnerability stemmed from debug logging that exposed raw Slack webhook URLs. The critical code is in connector.rs where HTTP requests are logged. Pre-patch versions (<1.3.2) contained a direct log statement using request.uri() without redaction for sensitive URLs. The commit diff shows the fix replaced request.uri() with a redacted uri_str in the debug log, and added hashing for sensitive URLs. This function handles request sending and logging, making it the clear source of exposure when handling webhook URLs marked as sensitive.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

WAF Protection Rules

WAF Rule

### Imp**t ***u* lo*s *xpos* s*nsitiv* URLs *or Sl**k w***ooks t**t *ont*in priv*t* in*orm*tion. ### P*t***s T** pro*l*m is *ix** in v*.*.* w*i** r****ts s*nsitiv* URLs *or w***ooks. ### Work*roun*s *is**lin*/*ilt*rin* ***u* lo*s in **s* you us* S

Reasoning

T** vuln*r**ility st*mm** *rom ***u* lo**in* t**t *xpos** r*w Sl**k w***ook URLs. T** *riti**l *o** is in `*onn**tor.rs` w**r* *TTP r*qu*sts *r* lo****. Pr*-p*t** v*rsions (<*.*.*) *ont*in** * *ir**t lo* st*t*m*nt usin* `r*qu*st.uri()` wit*out r****t