4.8

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

GHSA-gxhx-2686-5h9g

GHSA-gxhx-2686-5h9g: slack-go `SecretsVerifier` accepts empty signing secret without precondition

SecretsVerifier in slack-go/slack before v0.23.1 accepts an empty signing secret without error. If an application is misconfigured (e.g., an unset or empty SLACK_SIGNING_SECRET), NewSecretsVerifier builds an HMAC-SHA256 keyed with an empty string, allowing an unauthenticated attacker to forge a valid X-Slack-Signature and bypass Slack request authentication. Fixed in v0.23.1, which rejects empty secrets with ErrInvalidConfiguration. This is patched in version 0.23.1.

(GitHub Advisory)

Miggo Vulnerability Database

→

GHSA-gxhx-2686-5h9g

GHSA-gxhx-2686-5h9g:

4.8

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
github.com/slack-go/slack	go	< 0.23.1	0.23.1

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability exists in the slack-go library because the functions responsible for verifying request signatures, NewSecretsVerifier and unsafeSignatureVerifier, did not check if the signing secret was an empty string. When an empty string is used as the secret, the resulting HMAC key is predictable. This allows an attacker to forge the signature of incoming requests, bypassing authentication and potentially gaining unauthorized access to a Slack application's functionality. The patch addresses this by explicitly checking for an empty secret in unsafeSignatureVerifier and returning an ErrInvalidConfiguration error, thus preventing the creation of a verifier with a weak and insecure secret.

Vulnerable functions

NewSecretsVerifier

security.go

This function is used to create a new `SecretsVerifier`. Before the patch, it did not validate if the provided `secret` was an empty string. An empty secret results in a predictable HMAC key, which allows an attacker to bypass signature verification by forging requests. The function was vulnerable because it would proceed to create a verifier with a weak, known secret.

unsafeSignatureVerifier

security.go

This function, likely called by `NewSecretsVerifier`, contains the core logic for handling the signing secret. The vulnerability lies in the fact that it directly used the `secret` to initialize the HMAC without checking if it was empty. This allowed for the creation of a verifier with a compromised secret, undermining the security of the signature verification process.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.