AIKIDO-2025-10328
slack-ruby-client is vulnerable to Observable Timing Discrepancy
25
Low Risk
This Affects:
slack-ruby-clientTL;DR
Affected versions of this package use a simple string comparison instead of a constant-time comparison in the Slack::Event::Request#verify! method, leaving it vulnerable to timing attacks. This method is used for verifying incoming HTTP requests from Slack. An attacker could exploit this by carefully measuring the response time of signature verification attempts, allowing them to incrementally guess the correct signature and bypass security validations.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range.
Background info
slack-ruby-client is vulnerable to Observable Timing Discrepancy in versions 0.14.0 - 2.5.2.
How to fix this
Upgrade the slack-ruby-client library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
SOC 2Compliant
ISO 27001Compliant