Is this a security flaw in LinkedIn or a known behaviour

Question

LinkedIn owns a sub-site called LinkedIn Learning.

On September 9th, I took a LinkedIn skill assessment on one course.

As I have passed, LinkedIn offered me few courses, which you can see in the above image for free for only 24 hours

Here is where I saw a strange behavior. I went to LinkedIn Learning and browsed for other courses and I saw there are no options to view the course for free for 24 hours. i.e Only the course suggested by them can be viewed free for 24 hours.

I monitored the traffic to find how suggested courses get unlocked for free for 24 hours and not other courses. After spending some time in monitoring the traffic I saw a request like this:

https://www.linkedin.com/feed/update/urn:li:lyndaCourse:/?updateEntityUrn=urn%3Ali%3Afs_feedUpdate%3A(V2%26VOYAGER_SINGLE_UPDATE%2Curn%3Ali%3AlyndaCourse%3A379656)

I saw a strange parameter in the url like this: lyndaCourse:<COURSE_ID>

So, I thought, why not replace the course id of the free for viewing course with the course id of the locked course?

Fortunately, I was able to get the course id of the locked course by viewing the page source of the code with the parameter name

When a GET request is made after the replacing unlocked course id with the locked course, it gets unlocked for 24 hours.

My first thought was it would be an Indirect Object Reference Vulnerability because there are no options to unlock the paid course for free.

Now again **another strange behavior exhibited when analyzing the HTML source **

All the videos where actually meida, i.e just embed with video tags which allowed right click download of the videos.

I directly reported to them with screenshots and proof of concept videos, and I got this response.

So I thought they took this issue lightly and posted it on LinkedIn post and tagged them.

You can see that I have demonstrated with proof of concept video again in the post.

Here is the link to the post which have also tweeted and tagged them as per the advice of other security researchers to let them know.

https://www.linkedin.com/posts/visweswaran-nagasivam-975a8b167_kirstybonner-bug-jobs-activity-6577243206126268416-6L-X

I again mailed them with the link of the post and got this response.

For a moment I thought it is not a bug and a known feature but other security researchers are telling it is a bug. To prove my point I also wrote an automated program which exploits this bug and downloads all paid courses for free which is required for a month in bulk. And still they are claiming it is not a bug.

So my question is is this a bug or some known feature or expected behaviour?

If every course can be downloaded for free, what is the need for paying?

Answer 1

You and LinkedIn are talking about two different things.

1. You found a way to use an unlock function in their code to unlock any course you want
2. LinkedIn knows and is willing to take the risk

You want them to take the "bug" seriously. They want to take the risks seriously.

Is this a "bug"? No, a bug is an undesired or unintended function of the system. They know about this function's effects and have told you that they accept it and have means to limit their risks that you do not know about.

There is nothing wrong with this response.

Is this a "feature or expected behaviour"? No, it's an effect of their design choices. It does not (necessarily) provide them or their users a benefit and it might not have been designed to have this effect. It's a consequence of their design.

System effects can have negative impacts, positive impacts, or neutral impacts. For LinkedIn, they see this behaviour of the system as a neutral impact.

You are seeing that something bad could happen. They are seeing that the bad is tolerable and not worth the re-engineering of their system to change it.

Answer 2

So my question is is this a bug or some known feature or expected behaviour?

Well, I think unless there is someone here from the LinkedIn development team who can provide additional insights, it seems we will never know.

But, there are somethings we can point out that may indicate that this is not a bug but rather a feature that can be abused.

LinkedIn probably tried to make an easy integration with their learning site, to do this it was needed to use a flag/parameter such as the one you found. Because of the course being available only for 24 hours they probably did not put to much effort into it because well, what can already happen?

If we look at the business logic, the functionality of the parameter does exactly what it is supposed to and there for, this is a feature.

I think you have demonstrated that you can abuse this parameter to download any/all of the courses available on the site. If this is indeed important to them, they are now well aware of it and can probably make some easy changes to fix this, but keep in mind this may not be that important to them (LinkedIn is also known to sue anyone trying to use their data so they may feel comfortable worse comes to worse to use the law).

I would write a write up of what you have found, report it, and if you are told it is not an issue of any sort, you can probably publish it (I would recommend against this because of LinkedIn's experience with people using their data).