1

LinkedIn owns a sub-site called LinkedIn Learning.

On September 9th, I took a LinkedIn skill assessment on one course.

enter image description here

As I have passed, LinkedIn offered me few courses, which you can see in the above image for free for only 24 hours

Here is where I saw a strange behavior. I went to LinkedIn Learning and browsed for other courses and I saw there are no options to view the course for free for 24 hours. i.e Only the course suggested by them can be viewed free for 24 hours.

enter image description here

I monitored the traffic to find how suggested courses get unlocked for free for 24 hours and not other courses. After spending some time in monitoring the traffic I saw a request like this:

https://www.linkedin.com/feed/update/urn:li:lyndaCourse:/?updateEntityUrn=urn%3Ali%3Afs_feedUpdate%3A(V2%26VOYAGER_SINGLE_UPDATE%2Curn%3Ali%3AlyndaCourse%3A379656)

I saw a strange parameter in the url like this: lyndaCourse:<COURSE_ID>

So, I thought, why not replace the course id of the free for viewing course with the course id of the locked course?

Fortunately, I was able to get the course id of the locked course by viewing the page source of the code with the parameter name

enter image description here

When a GET request is made after the replacing unlocked course id with the locked course, it gets unlocked for 24 hours.

enter image description here

My first thought was it would be an Indirect Object Reference Vulnerability because there are no options to unlock the paid course for free.

Now again **another strange behavior exhibited when analyzing the HTML source **

All the videos where actually meida, i.e just embed with video tags which allowed right click download of the videos.

I directly reported to them with screenshots and proof of concept videos, and I got this response.

enter image description here

So I thought they took this issue lightly and posted it on LinkedIn post and tagged them.

You can see that I have demonstrated with proof of concept video again in the post.

Here is the link to the post which have also tweeted and tagged them as per the advice of other security researchers to let them know.

https://www.linkedin.com/posts/visweswaran-nagasivam-975a8b167_kirstybonner-bug-jobs-activity-6577243206126268416-6L-X

I again mailed them with the link of the post and got this response.

enter image description here

For a moment I thought it is not a bug and a known feature but other security researchers are telling it is a bug. To prove my point I also wrote an automated program which exploits this bug and downloads all paid courses for free which is required for a month in bulk. And still they are claiming it is not a bug.

So my question is is this a bug or some known feature or expected behaviour?

If every course can be downloaded for free, what is the need for paying?

  • It does look like a bug,but most probably company knows about it.Did you tell them the impact of abusing this? – Vipul Nair Sep 13 at 16:16
  • @VipulNair told everything to them everything posted here(Screenshots) were sent as video to them. – VISWESWARAN NAGASIVAM Sep 13 at 16:19
  • Nothing much you can do then.Write up a full disclosure if you want.Thats all. – Vipul Nair Sep 13 at 16:52
  • @VipulNair All I wanted to know is whether it is a security bug/ flaw or not like if every course can be downloaded for free what is the need for paying? – VISWESWARAN NAGASIVAM Sep 13 at 16:56
  • 4
    Did LinkedIn not already answer this? Looks like they said it is a known design behavior. – Xander Sep 13 at 16:59
6
+100

You and LinkedIn are talking about two different things.

  1. You found a way to use an unlock function in their code to unlock any course you want
  2. LinkedIn knows and is willing to take the risk

You want them to take the "bug" seriously. They want to take the risks seriously.

Is this a "bug"? No, a bug is an undesired or unintended function of the system. They know about this function's effects and have told you that they accept it and have means to limit their risks that you do not know about.

There is nothing wrong with this response.

Is this a "feature or expected behaviour"? No, it's an effect of their design choices. It does not (necessarily) provide them or their users a benefit and it might not have been designed to have this effect. It's a consequence of their design.

System effects can have negative impacts, positive impacts, or neutral impacts. For LinkedIn, they see this behaviour of the system as a neutral impact.

You are seeing that something bad could happen. They are seeing that the bad is tolerable and not worth the re-engineering of their system to change it.

  • In mail what I am trying to convey to LinkedIn was everyone might steal the course and instructors hard work... If everyone can download everything what is the need for payment. That was my thought , so you are saying LinkedIn doesn't care. So I should leave it? – VISWESWARAN NAGASIVAM Sep 16 at 7:20
  • 1
    No, you've missed my point entirely. They do care. But only up to a point. It's not a matter of "yes" or "no", "good" or "bad", "fixed" or "broken". It's a weakness that they have mitigations for. – schroeder Sep 16 at 7:32
  • @schroeder" Is this a "bug"? No, a bug is an undesired or unintended function of the system" To me, it seems at least plausible that that didn't intend things to be exploitable in this way (and therefore probably is a bug), but – as you say in your last paragraph – the potential to exploit it doesn't trouble them enough to either immediately fix things, or suspend the facility while they do fix it. – TripeHound Sep 16 at 10:10
  • Is this a materially different answer to @BubbleHacker 's post? – LTPCGO Sep 17 at 1:10
  • Thank you sir for the most brief answer! 100 of my reputation points well spent! – VISWESWARAN NAGASIVAM Sep 17 at 8:39
1

So my question is is this a bug or some known feature or expected behaviour?

Well, I think unless there is someone here from the LinkedIn development team who can provide additional insights, it seems we will never know.

But, there are somethings we can point out that may indicate that this is not a bug but rather a feature that can be abused.

LinkedIn probably tried to make an easy integration with their learning site, to do this it was needed to use a flag/parameter such as the one you found. Because of the course being available only for 24 hours they probably did not put to much effort into it because well, what can already happen?

If we look at the business logic, the functionality of the parameter does exactly what it is supposed to and there for, this is a feature.

I think you have demonstrated that you can abuse this parameter to download any/all of the courses available on the site. If this is indeed important to them, they are now well aware of it and can probably make some easy changes to fix this, but keep in mind this may not be that important to them (LinkedIn is also known to sue anyone trying to use their data so they may feel comfortable worse comes to worse to use the law).

I would write a write up of what you have found, report it, and if you are told it is not an issue of any sort, you can probably publish it (I would recommend against this because of LinkedIn's experience with people using their data).

  • How could they sue me, I have told them before making anything public. – VISWESWARAN NAGASIVAM Sep 14 at 3:33
  • 2
    @VISWESWARANNAGASIVAM, I am not a lawyer but by making code accessible or pointing people in the right direction to how to download the courses for free, you are helping in a crime. This is an assumption. – Bubble Hacker Sep 14 at 15:19
  • 1
    @VISWESWARAN NAGASIVAM No, you'd made it publicly before it was fixed. (assume this was a valid bug to them) – tungsten Sep 16 at 12:28
  • 1
    @VISWESWARANNAGASIVAM Anyone can sue anyone, the question is whether they'd survive summary judgement and eventually win, and whether you're willing to pay a lawyer to fight them. Also whether you're in a jurisdiction they'd be willing to litigate in, but that's a broader question. – IllusiveBrian Sep 16 at 13:25

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.