A new vulnerability discovered in LinkedIn AutoFill functionality leaks users sensitive information to 3rd party websites.
LinkedIn provides an AutoFill a future for other websites to fill information such as LinkedIn user’s name, email address, phone number, location, and job.
This Linkedin provides only for paying customers of LinkedIn’s Marketing Solutions increases the volume and quality of conversions.
Customer domains must be whitelisted for LinkedIn AutoFill to function properly, but this vulnerability could abuse this restriction and leaks the sensitive information.
This Vulnerability allowed an attacker to steal your full name, phone number, email address, ZIP code, company and job title.
In this case, If any of those sites have cross-site scripting vulnerabilities, which Cable confirmed some do, hackers can still run AutoFill on their sites by installing an iframe to the vulnerable whitelisted site,Techcrunch says.
Exposed LinkedIn Flaw working in the following ways,
- The user visits the malicious site, which loads the LinkedIn AutoFill button iframe.
- The iframe is styled so it takes up the entire page and is invisible to the user.
- The user clicks anywhere on the page. LinkedIn interprets this as the AutoFill button being pressed, and sends the information via
postMessageto the malicious site.
According to researcher Jack Cable , “It seems like LinkedIn accepts the risk of whitelisted websites (and it is a part of their business model), yet this is a major security concern,”
This leads , a compromise in any of the whitelisted websites would have exposed the information of LinkedIn users to malicious hackers.
He discovered the issue on April 9th, 2018 and immediately disclosed it to LinkedIn. The company issued a fix on April 10th but didn’t inform the public of the issue.
