HackerOne declared the issue out of scope so I don't see why disclosure would ma...

mmsc · 2024-10-12T15:00:41 1728745241

>HackerOne declared the issue out of scope so I don't see why disclosure would make a difference here.

Indeed, but just you wait for Zendesk to say "well, _we_ didn't mark it out of scope!" as if delegating it to h1 renegades all responsibility.

justusthane · 2024-10-13T14:04:49 1728828289

They did, though. The post also quotes a response from Zendesk declaring it out of scope.

cjbprime · 2024-10-12T17:17:15 1728753435

(There's a not-very-convincing argument that they declared the ability to view support tickets as out of scope, but were not given a chance to assess the Slack takeover exploit's scope.)

nodamage · 2024-10-12T17:22:32 1728753752

The Slack takeover exploit is a problem on Slack's end (and sounds more like a configuration issue than a bug) so Zendesk would not be responsible for that anyway though.

a_dabbler · 2024-10-13T12:10:24 1728821424

I disagree, the problem is clearly on Zendesks end.

nodamage · 2024-10-13T16:46:53 1728838013

Don't get me wrong, Zendesk definitely has their own separate problem: you should not be able to CC yourself onto an existing support ticket by emailing a guessable ticket ID.

But simultaneously you should not be able to get into a company Slack by simply having an account with a @company.com email address created by a third-party SSO provider.

In other words, even in Zendesk fixed their problem, Slack would still have a problem on their end.