LinkedIn owns a sub-site called LinkedIn Learning.
On September 9th, I took a LinkedIn skill assessment on one course.
As I have passed, LinkedIn offered me few courses, which you can see in the above image for free for only 24 hours
Here is where I saw a strange behavior. I went to LinkedIn Learning and browsed for other courses and I saw there are no options to view the course for free for 24 hours. i.e Only the course suggested by them can be viewed free for 24 hours.
I monitored the traffic to find how suggested courses get unlocked for free for 24 hours and not other courses. After spending some time in monitoring the traffic I saw a request like this:
I saw a strange parameter in the url like this:
So, I thought, why not replace the course id of the free for viewing course with the course id of the locked course?
Fortunately, I was able to get the course id of the locked course by viewing the page source of the code with the parameter name
When a GET request is made after the replacing unlocked course id with the locked course, it gets unlocked for 24 hours.
My first thought was it would be an Indirect Object Reference Vulnerability because there are no options to unlock the paid course for free.
Now again **another strange behavior exhibited when analyzing the HTML source **
All the videos where actually meida, i.e just embed with video tags which allowed right click download of the videos.
I directly reported to them with screenshots and proof of concept videos, and I got this response.
So I thought they took this issue lightly and posted it on LinkedIn post and tagged them.
You can see that I have demonstrated with proof of concept video again in the post.
Here is the link to the post which have also tweeted and tagged them as per the advice of other security researchers to let them know.
I again mailed them with the link of the post and got this response.
For a moment I thought it is not a bug and a known feature but other security researchers are telling it is a bug. To prove my point I also wrote an automated program which exploits this bug and downloads all paid courses for free which is required for a month in bulk. And still they are claiming it is not a bug.
So my question is is this a bug or some known feature or expected behaviour?
If every course can be downloaded for free, what is the need for paying?