LinkedIn AutoFill Flaw in Plugin – Third Party Sites Steal your Data

LinkedIn AutoFill Flaw in Plugin – Third Party Sites Steal your Data

Not just Facebook, a brand New vulnerability discovered in Linkedin’s favorite AutoFill performance discovered leaking its user’s very sensitive info to 3rd party websites without the user knowing about it.

LinkedIn provides an AutoFill plug-in for quite a very long time that other websites may use to allow LinkedIn users rapidly fill in profile information, including their entire name, telephone number, e-mail address, Zipcode, business and job name, with one click. Generally, the AutoFill button only works on especially whitelisted websites, but what the AutoFill button only works on as stated, isn’t merely the case.

Cable discovered that the feature was plagued with a simple yet important security vulnerability that potentially enabled any website (scrapers) secretly harvest user profile data and the user will not even realize the event.

A legitimate website would probably place an AutoFill button near the fields the button may fill, but based on Cable, an attacker website can alter its attributes to spread the button across the entire webpage while being invisible and after that make it undetectable.

Considering that the AutoFill button is imperceptible, users can click on anyplace on the website and it will activate AutoFill, eventually sending all the users public and private information requested to the malicious website.


Here’s How attackers can exploit the LinkedIn Flaw:

  • User visits the malicious website, which loads the LinkedIn AutoFill button iframe.
  • The iframe is styled in a way that it takes up the entire page and is invisible to the user.
  • The user then clicks anywhere on that page, and LinkedIn interprets this as the AutoFill button being pressed and sends the users’ data via postMessage to the malicious site.
Cable discovered the vulnerability on April 9th and immediately disclosed it to LinkedIn. The company issued a temporary fix the next day without informing the public of the issue.

The fix only restricted the use of LinkedIn’s AutoFill feature to whitelisted websites only who pay LinkedIn to host their advertisements, but Cable argued that the patch was incomplete and still left the feature open to abuse as whitelisted sites still could have collected user data.Besides this, if any of the sites whitelisted by LinkedIn gets compromised, the AutoFill feature could be abused to send the collected data to malicious third-parties.

To demonstrate the issue, Cable also built a proof-of-concept test page, which shows how a website can grab your first and last name, email address, employer, and location.

Since a complete fix for the vulnerability was rolled out by LinkedIn on April 19, the above demo page might not work for you now.

“We immediately prevented unauthorized use of this feature, once we were made aware of the issue. We are now pushing another fix that will address potential additional abuse cases, and it will be in place shortly,” the company said in a statement.

“While we’ve seen no signs of abuse, we’re constantly working to ensure our members’ data stays protected. We appreciate the researcher responsible reporting this, and our security team will continue to stay in touch with them.”

Although the vulnerability is not at all a sophisticated or critical one, given the recent Cambridge Analytica scandal wherein data of over 87 million Facebook users was exposed, such security loopholes can pose a serious threat not only to the customers but also the company itself.

Source: The Hacker News

One comment

Add comment

This site uses Akismet to reduce spam. Learn how your comment data is processed.