VYPR
Get started
← All advisories
High severityNVD Advisory· Published Oct 10, 2022· Updated Apr 23, 2025

Exposure of sensitive Slack webhook URLs in debug logs and traces

CVE-2022-39292

Description

Slack Morphism is a modern client library for Slack Web/Events API/Socket Mode and Block Kit. Debug logs expose sensitive URLs for Slack webhooks that contain private information. The problem is fixed in version 1.3.2 which redacts sensitive URLs for webhooks. As a workaround, people who use Slack webhooks may disable or filter debug logs.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
slack-morphismcrates.io
< 1.3.21.3.2

Affected products

1

Patches

2
48a1da2dc2ad

Redacted hash support

https://github.com/abdolence/slack-morphism-rustAbdulla AbdurakhmanovOct 8, 2022via ghsa
commit
1 file changed · +10 −3
  • src/hyper_tokio/connector.rs+10 −3 modified
    @@ -12,6 +12,8 @@ use rvstruct::ValueStruct;
 
 use crate::prelude::hyper_ext::HyperExtensions;
 use crate::ratectl::SlackApiRateControlConfig;
+use std::hash::Hash;
+use std::hash::Hasher;
 use std::sync::Arc;
 use std::time::Duration;
 use tracing::*;
@@ -70,8 +72,12 @@ impl<H: 'static + Send + Sync + Clone + connect::Connect> SlackClientHyperConnec
         RS: for<'de> serde::de::Deserialize<'de>,
     {
         let uri_str = if context.is_sensitive_url {
+            let mut hasher = std::collections::hash_map::DefaultHasher::new();
+            request.uri().path().to_string().hash(&mut hasher);
+            let u64 = hasher.finish();
+
             format!(
-                "{}://{}/-redacted-",
+                "{}://{}/-redacted-/{}",
                 request
                     .uri()
                     .scheme()
@@ -81,7 +87,8 @@ impl<H: 'static + Send + Sync + Clone + connect::Connect> SlackClientHyperConnec
                     .uri()
                     .host()
                     .map(|host| host.to_string())
-                    .unwrap_or_else(|| "unknown-host".to_string())
+                    .unwrap_or_else(|| "unknown-host".to_string()),
+                u64
             )
         } else {
             request.uri().to_string()
@@ -91,7 +98,7 @@ impl<H: 'static + Send + Sync + Clone + connect::Connect> SlackClientHyperConnec
             debug!(
                 slack_uri = uri_str.as_str(),
                 "Sending HTTP request to {}",
-                request.uri()
+                uri_str.as_str()
             );
         });
65ef9fac4f39

Slack Webhook URL redacted from debug logs

https://github.com/abdolence/slack-morphism-rustAbdulla AbdurakhmanovOct 8, 2022via ghsa
commit
4 files changed · +26 −2
  • Cargo.toml+1 −1 modified
    @@ -1,6 +1,6 @@
 [package]
 name = "slack-morphism"
-version = "1.3.0"
+version = "1.3.1-alpha.0"
 authors = ["Abdulla Abdurakhmanov <me@abdolence.dev>"]
 edition = "2021"
 license = "Apache-2.0"
  • src/api/webhook.rs+1 −0 modified
    @@ -33,6 +33,7 @@ where
             rate_control_params: Some(&POST_WEBHOOK_SPECIAL_LIMIT_RATE_CTL),
             token: None,
             tracing_span: &http_webhook_span,
+            is_sensitive_url: true,
         };
 
         self.http_api
  • src/client.rs+5 −0 modified
    @@ -52,6 +52,7 @@ pub struct SlackClientApiCallContext<'a> {
     pub rate_control_params: Option<&'a SlackApiMethodRateControlConfig>,
     pub token: Option<&'a SlackApiToken>,
     pub tracing_span: &'a Span,
+    pub is_sensitive_url: bool,
 }
 
 pub trait SlackClientHttpConnector {
@@ -238,6 +239,7 @@ where
             rate_control_params,
             token: Some(self.token),
             tracing_span: &self.span,
+            is_sensitive_url: false,
         };
 
         self.client
@@ -262,6 +264,7 @@ where
             rate_control_params,
             token: Some(self.token),
             tracing_span: &self.span,
+            is_sensitive_url: false,
         };
 
         self.client
@@ -285,6 +288,7 @@ where
             rate_control_params,
             token: Some(self.token),
             tracing_span: &self.span,
+            is_sensitive_url: false,
         };
 
         self.client
@@ -308,6 +312,7 @@ where
             rate_control_params,
             token: Some(self.token),
             tracing_span: &self.span,
+            is_sensitive_url: false,
         };
 
         self.client
  • src/hyper_tokio/connector.rs+19 −1 modified
    @@ -69,7 +69,24 @@ impl<H: 'static + Send + Sync + Clone + connect::Connect> SlackClientHyperConnec
     where
         RS: for<'de> serde::de::Deserialize<'de>,
     {
-        let uri_str = request.uri().to_string();
+        let uri_str = if context.is_sensitive_url {
+            format!(
+                "{}://{}/<redacted>",
+                request
+                    .uri()
+                    .scheme()
+                    .map(|scheme| scheme.to_string())
+                    .unwrap_or_else(|| "unknown-scheme".to_string()),
+                request
+                    .uri()
+                    .host()
+                    .map(|host| host.to_string())
+                    .unwrap_or_else(|| "unknown-host".to_string())
+            )
+        } else {
+            request.uri().to_string()
+        };
+
         context.tracing_span.in_scope(|| {
             debug!(
                 slack_uri = uri_str.as_str(),
@@ -287,6 +304,7 @@ impl<H: 'static + Send + Sync + Clone + connect::Connect> SlackClientHttpConnect
                 rate_control_params: None,
                 token: None,
                 tracing_span: &http_oauth_span,
+                is_sensitive_url: false,
             };
 
             self.send_rate_controlled_request(

Vulnerability mechanics

Generated by null/stub on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

7

News mentions

0

No linked articles in our index yet.