Linkedin's Clickjacking & Open Url Redirection Vulnerabilities

[Ajay Singh Negi <ajaysinghnegi01 () gmail com>]

 Linkedin's Clickjacking & Open Url Redirection Vulnerabilities

# Vulnerability Title: Secondary Email Addition & Deletion Via Click
Jacking in Linkedin
# Website Link:  [Tried on Indian version]
# Found on: 06/08/2012
# Author:  Ajay Singh Negi
# Version: [All language versions would be vulnerable]
# Tested on: [Indian version]
# Reported On: 07/08/2012
# Status: Fixed
# Patched On: 10/09/2012
# Public Release: 15/09/2012




*Summary*

A Clickjacking vulnerability existed on Linkedin that allowed an attacker
to add or delete a secondary email and can also make existing secondary
email as primary email by redressing the manage email page.

*Details*

Linkedin manage email page (a total of 1 page) was lacking X-FRAME-OPTIONS
in Headers and Frame-busting javascript  measures to prevent framing of the
pages. So the manage email page could be redressed to 'click-jack' Linkedin
users. Below I have mentioned the vulnerable Url.


*1. Click Jacking Vulnerable Url:*
https://www.linkedin.com/settings/manage-email?goback=.nas_*1_*1_*1<http://www.google.com/url?q=https%3A%2F%2Fwww.linkedin.com%2Fsettings%2Fmanage-email%3Fgoback%3D.nas_*1_*1_*1&sa=D&sntz=1&usg=AFQjCNGkjluV_mUQz-l0-O4AE2x6J5lKqA>



# Vulnerability Title: Open Url Redirection in Linkedin
# Website Link:  [Tried on Indian version]
# Found on: 05/08/2012
# Author:  Ajay Singh Negi
# Version: [All language versions would be vulnerable]
# Tested on: [Indian version]
# Reported On: 06/08/2012
# Status: Fixed
# Patched On: 07/09/2012
# Public Release: 15/09/2012



*Summary*

Open Url Redirection using which an attacker can redirect any Linkedin user
to any malicious website. Below I have mentioned the vulnerable Url.


*Original Open Url Redirection Vulnerable Url:*

https://help.linkedin.com/app/utils/log_error/et/0/ec/7/callback/https%3A%2F%2Fhelp.linkedin.com%2Fapp%2Fhome%2Fh%2Fc%2Ffrom_auth%2Ftrue



*Crafted Open Url Redirection Vulnerable Url:*
https://help.linkedin.com/app/utils/log_error/et/0/ec/7/callback/http%3A%2F%2Fattacker.in<http://www.google.com/url?q=https%3A%2F%2Fhelp.linkedin.com%2Fapp%2Futils%2Flog_error%2Fet%2F0%2Fec%2F7%2Fcallback%2Fhttp%253A%252F%252Fattacker.in&sa=D&sntz=1&usg=AFQjCNHwFbje3XOKHpKQ48bGat-sG-MjCQ>


POC can be found on below mentioned Url:
http://computersecuritywithethicalhacking.blogspot.in/2012/09/linkedins-clickjacking-open-url.html

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/