Slack Morphism Rust
Monthly
Slack Morphism 1.0.0 through 2.27.0 writes the correct Slack request HMAC into its error output when signature verification fails, so anyone who can both hit the app's Slack callback endpoint and read its application or service logs can use the verifier as a chosen-message HMAC oracle and replay a fully signed request within Slack's five-minute freshness window - without ever knowing the signing secret. The exposure only occurs in deployments using the default Axum or Hyper listener error handler, which logs `SlackEventWrongSignatureError` (including the public `generated_hash` field) at error level; applications with a custom handler that suppresses the hash are not affected. The vendor released 2.28.0 to remove the expected signature from the error type, and no public exploit code has been identified at time of analysis; real-world risk is bounded by the mandatory log-read access, the tight replay window, and the fact that a forged request is confined to the exact body and timestamp the oracle signed.
Slack Morphism 1.0.0 through 2.27.0 writes the correct Slack request HMAC into its error output when signature verification fails, so anyone who can both hit the app's Slack callback endpoint and read its application or service logs can use the verifier as a chosen-message HMAC oracle and replay a fully signed request within Slack's five-minute freshness window - without ever knowing the signing secret. The exposure only occurs in deployments using the default Axum or Hyper listener error handler, which logs `SlackEventWrongSignatureError` (including the public `generated_hash` field) at error level; applications with a custom handler that suppresses the hash are not affected. The vendor released 2.28.0 to remove the expected signature from the error type, and no public exploit code has been identified at time of analysis; real-world risk is bounded by the mandatory log-read access, the tight replay window, and the fact that a forged request is confined to the exact body and timestamp the oracle signed.