CSRF that makes any linkedin user follow attacker controlled accounts by simply clicking https://www.linkedin.com/comm/mynetwork/discovery-see-all/*

Summary

The researcher identified a CSRF issue which could potentially trick a member into following an account without additional confirmation by clicking a specially crafted URL.

The PoC link was as follows -

https://www.linkedin.com/comm/mynetwork/discovery-see-all/?usecase=EMAIL_MIXED_RECOMMENDATIONS&entityUrn=urn:li:fs_DiscoveryEntity:(urn:li:member:<USER-ID>,PEOPLE_FOLLOW)&trk=eml-edge-discover&midToken=AQGOWzyQBc3Qug&midSig=0U3avif_ryOWI1&trkEmail=eml-email_edge_discover_01-recommended_edges-4-cta_pf-null-h3akrx~lgrx0iea~dl-null-neptune/mynetwork.discovery~see~all&lipi=urn:li:page:email_email_edge_discover_01;CJWMj7vwSYGntneNwUgFrQ==

Here <USER-ID> is the fsd_profile value that is publicly available. Using this crafted link it was possible to make any user on linkedin follow us once they click on it.