Description (CNA)
The Trigger.dev webapp before 4.5.12 contains a cross-site request forgery vulnerability in its organization-level Slack OAuth flow, which uses the organization ID as the OAuth state without binding it to the initiating session. Attackers who know a target organization ID can trick an authenticated member into opening an unredeemed /integrations/slack/callback URL, connecting an attacker-controlled Slack workspace that may receive the organization's operational alerts.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| triggerdotdev / trigger.dev | affected 0 before 4.5.12; unaffected 4.5.12 |
CWE
CWE-352
References
- https://github.com/triggerdotdev/trigger.dev/security/advisories/GHSA-hc5h-gqhc-4h79
- https://www.vulncheck.com/advisories/trigger-dev-before-4.5.12-csrf-via-slack-oauth-callback-state
ADP enrichment
No English description supplied.
No references supplied.