CSRF that makes any user send invitations to the attacker by simply clicking on a link.

Summary

The researcher found a CSRF issue that allowed targeted links (intended and usable only by a single member) to send connection invitations once clicked on without any prompt/intermediary step to confirm such action. Thank you @marvelmaniac for the report!

The PoC link was as follows -

https://www.linkedin.com/comm/mynetwork/send-invite/<USERNAME>/?lipi=urn:li:page:email_email_pymk_02;3MPU3ZpvSH6FxK37sN6PTA==&midSig=1H88TLaeqmRWI1&midToken=AQGOWzyQBc3Qug&trkEmail=eml-email_pymk_02-pymkCard-0-cta-null-h3akrx~lguw0uex~xs-null-null&trk=eml-email_pymk_02-pymkCard-0-cta&_sig=0y-j3QtmmmRWI1

Here the <username> is the Public Profile URL name. It was possible to make any user send connection invites to ourselves by simply providing them with the above crafted link.