An attacker can submit arbitrary projects to their service accounts and obtain full information on projects of other users.

Summary

An IDOR issue was discovered in the Request Services feature, where an attacker can gain access to project details of other users by submitting work project requests. Henceforth, an attacker can obtain the details of project submitted to other service providers and submit their own proposals to the victim(owner of the project). We have resolved the issue on priority and paid a bounty to researcher.

A IDOR issue was found in the Request Services feature of Linkedin where an attacker can gain work in the platform in unauthorized manner by submitting work projects of arbitrary users on Linkedin to themselves. Projects are created when we request a service from a service provider on linkedin and it is treated confidential data which can only be viewed by the owner and the service provider which the owner choose. However due to the IDOR issue, an attacker can obtain the project submitted to other service providers and submit their own proposals to the victim( owner of the project). This way they can gain work on the Linkedin platform. No user interaction was needed. ProjectIDs are integers and can be iterated.

{F3067774} {F3067782}

Vulnerable Request -

POST /voyager/api/voyagerMarketplacesDashServiceMarketplaceEngagement?action=createEngagementV2&decorationId=com.linkedin.voyager.dash.deco.marketplaces.CreateEngagementResponse-4
Host: www.linkedin.com
.
.
.

{"projectUrn":"urn:li:fsd_marketplaceProject:(<PROJECT-ID>,SERVICE_MARKETPLACE)","providerProfileUrn":"urn:li:fsd_profile:<ATTACKER--SERVICE-ACCOUNT-ID>"}