CVE-2022-31162
📋 TL;DR
Slack Morphism Rust library versions before 0.41.0 could leak Slack OAuth client secrets in debug logs. This exposes authentication credentials that could allow attackers to impersonate applications. Any Rust application using vulnerable versions of slack-morphism-rust for Slack integrations is affected.
💻 Affected Systems
- slack-morphism-rust
📦 What is this software?
Slack Morphism by Slack Morphism Project
⚠️ Risk & Real-World Impact
Worst Case
Attackers obtain OAuth secrets from logs, impersonate the Slack application, access sensitive Slack workspace data, and potentially compromise connected systems.
Likely Case
Unauthorized access to Slack channels, messages, and workspace data if logs containing OAuth secrets are exposed.
If Mitigated
Minimal impact with proper log sanitization and access controls preventing exposure of debug logs.
🎯 Exploit Status
Exploitation depends on access to debug logs. No authentication bypass required once logs are accessible.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 0.41.0 and later
Vendor Advisory: https://github.com/abdolence/slack-morphism-rust/security/advisories/GHSA-99j7-mhfh-w84p
Restart Required: Yes
Instructions:
1. Update Cargo.toml to require slack-morphism >=0.41.0
2. Run 'cargo update slack-morphism'
3. Rebuild and redeploy your application
4. Restart all services using the library
🔧 Temporary Workarounds
Disable OAuth debug logging
allConfigure application logging to exclude OAuth requests/responses and client configurations from debug output.
Configure log filters to exclude slack_morphism::client and slack_morphism::oauth modules from debug logging
🧯 If You Can't Patch
- Implement strict access controls on application logs to prevent unauthorized access
- Configure log aggregation systems to filter or redact OAuth-related entries before storage
🔍 How to Verify
Check if Vulnerable:
Check Cargo.lock or Cargo.toml for slack-morphism version <0.41.0Check Version:
grep -A2 'name = "slack-morphism"' Cargo.lock | grep versionVerify Fix Applied:
Confirm slack-morphism version >=0.41.0 in Cargo.lock and test that OAuth secrets are not printed in debug logs📡 Detection & Monitoring
Log Indicators:
- Debug logs containing 'client_secret', 'access_token', 'refresh_token', or other OAuth credentials from slack-morphism operations
Network Indicators:
- Unusual Slack API requests from unexpected sources using potentially leaked credentials
SIEM Query:
source="application_logs" AND "slack-morphism" AND ("client_secret" OR "access_token" OR "refresh_token")🔗 References
- https://github.com/abdolence/slack-morphism-rust/releases/tag/v0.41.0
- https://github.com/abdolence/slack-morphism-rust/security/advisories/GHSA-99j7-mhfh-w84p
- https://github.com/abdolence/slack-morphism-rust/releases/tag/v0.41.0
- https://github.com/abdolence/slack-morphism-rust/security/advisories/GHSA-99j7-mhfh-w84p
