World’s largest professional network LinkedIn That has more than 500 Million Registered users. LinkedIn messenger Platform Vulnerability Allows attacker spread Malware into victims by taking advantage of LinkedIn’s security restrictions Flow.
LinkedIn messenger is the Mostly used Future Platform which helps for professional Community to Share their skills, Messenger easily sends resumes, transfer academic research and share job descriptions from the LinkedIn community.
Normally, LinkedIn security restrictions scan the Malicious activities of the attached File when user send valid files via messenger.
But this LinkedIn messenger Flow allows attacker bypass the LinkedIn security restriction and send a Malicious file which normally looks like a legitimate file but actually its Malicious one.
Based on the LinkedIn Security Restriction, following file format allow to upload and attach to a message.
- Documents – csv, xls, xlsx, doc, docx, ppt, pptx, pdf, txt.
- Images– gif, jpeg, jpg, png.
Also Read: Bypass an Anti-Virus Detection with Encrypted Payloads using VENOM Tool
How Does This Vulnerability Works
This Vulnerability Allows to Attacker upload any Malicious file into LinkedIn messenger by Modifying the file Extension of the Malicious file.
According to Checkpoint Research, A PowerShell script was uploaded into LinkedIn messenger by modifying the Malicious file Extension as .pdf .
Malicious File uploading into LinkedIn
Later, Attacker Successfully sends the Malicious file by controls the name of the file (Name parameter), the format of the file (MediaType parameter), and the file extension.
In this Below Response , we could see that LinkedIn Security Restriction will be allowed(Virus Not Detected) to upload the Malicious file because of Modifying the File Extension.
LinkedIn Virus Check ByPassed
so Finally Malicious File will be successfully uploaded without detecting by the LinkedIn security restrictions and once Victims click the file then it will be triggered and successfully infect the victim’s Machine.
Video Demo For Malware Upload into Messenger
Also Abuse the DOCX, XLSM file with embedded Malicious Macro then uploaded successfully to LinkedIn’s CDN, passing the virus check and sent to the victim.later Victims will be Compromised by the Malware.
Checkpoint Reported to LinkedIn Security on 14 June 2017 and LinkedIn Successfully Fixed the Issue.
