The Story Behind LinkedIn Security Flaw - December/2017
Before I start, I have to thank Tom Warren from the @verge... keep reading to know why...
Last month on November 20, I found a vulnerability in LinkedIn which is PHP Injection due to bad filter. The vulnerability exists in the endpoint:
https://www.linkedin.com/voyager/api/feed/shares?action=create
The vulnerability allowed the modification of the "url" variable in the SRC attribute of the uploaded image, leading to potential attacks where users' details could be compromised when the image is clicked.
I sent my first report to
Hi Khalil,
Thanks for reaching out to us. After careful consideration of your report, we believe this does not represent a security vulnerability as it requires explicit user interaction. It is similar to phishing emails. LinkedIn members can use the “Report this post” feature if they encounter such issues.
If you can find a way to trigger code execution automatically, please write back to us.
Regards,
Sanjay
I was shocked by this response, so I escalated the issue by providing more detailed proofs of concept (POC). Here are some of the POC videos I shared:
- POC on PC via Internet Explorer
- POC on mobile via Chrome (latest version) and Dolphin (latest version)
After further discussions, LinkedIn did not consider it a security vulnerability. Frustrated, I contacted Tom from The Verge, who tested the issue and brought it to the attention of Microsoft and LinkedIn employees. Finally, I received this email:
Hi Khalil,
We have confirmed that this issue has been resolved. Please test it on your end and let us know if you encounter any issues. We appreciate your efforts in helping to protect LinkedIn members.
Regards,
Sanjay
Strange, right? I told Tom it’s the power of media! 😄
Check out Tom Warren’s article on this issue: The Verge Article
Here are the POC videos I provided to Sanjay:
LinkedIn Exploit on Quantum:
