Cross-Site Request Forgery in Trigger.dev Webapp

Executive Summary

This is a Cross-Site Request Forgery (CSRF) vulnerability in Trigger.dev's Slack OAuth flow before version 4.5.12. The app uses the organization ID as the OAuth state parameter without linking it to the user's session. Attackers who know a target organization's ID can trick an authenticated member into visiting a malicious callback URL, which connects an attacker-controlled Slack workspace to receive the organization's operational alerts.

Useful 0 Not Useful 0

Detection Guidance

Check Trigger.dev version with npm list trigger.dev or by inspecting the webapp's package.json. Monitor Slack OAuth callback URLs for unexpected integrations in admin panels. Look for unauthorized Slack workspace connections linked to your organization ID.

Useful 0 Not Useful 0

Impact Analysis

If exploited, this vulnerability could allow an attacker to receive your organization's operational alerts in their Slack workspace. This might expose sensitive workflow data or operational details. The attack requires the attacker to know your organization ID and trick you into clicking a malicious link while authenticated.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could potentially affect compliance with GDPR and HIPAA by enabling unauthorized access to operational alerts. If an attacker gains access to an organization's Slack workspace through this CSRF flaw, they may intercept sensitive operational data, which could include personal or protected health information. This unauthorized data exposure may violate GDPR's data protection requirements and HIPAA's safeguards for protected health information.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade Trigger.dev to version 4.5.12 or later immediately. Review and revoke any unauthorized Slack integrations in your organization's admin settings. Audit OAuth tokens and callback URLs for suspicious activity.

Useful 0 Not Useful 0