LinkedIn AutoFill plugin bug left user data exposed

The flaw, now patched, could have allowed attackers to steal personal data undetected

code

An AutoFill plugin offered to LinkedIn members was affected by a bug that could have allowed an attacker to steal users' personal data.

The feature, which is offered to paying customers of LinkedIn's Marketing Solutions, allows a user to fill a website's form with their personal information, such as name, email address, phone number and place of work, at the click of a button.

Advertisement - Article continues below

If any of the websites compatible with the plugin contained a cross-site scripting (XSS) flaw that enabled an attacker to run malicious code, it would allow them to exploit the domain and steal any profile data the sites would retrieve from the user.

The flaw, which has now been patched according to LinkedIn, was flagged by teenage white hat hacker Jack Cable, who reported the vulnerability to LinkedIn and created a Proof of Concept demonstration to show how an attacker could run code to steal user data.

Although LinkedIn claims its AutoFill plugin was only compatible with domains it had whitelisted, Cable demonstrated that any website could have been a source of abuse until early April, when a patch was first applied.

The patch, put into action on 10 April, according to Cable, restricted AutoFill to whitelisted sites only. But the bug remained in the plugin until a second patch was applied on 19 April.

Advertisement
Advertisement - Article continues below
Advertisement - Article continues below

LinkedIn said in a statement: "We immediately prevented unauthorized use of this feature, once we were made aware of the issue. We are now pushing another fix that will address potential additional abuse cases and it will be in place shortly.

"While we've seen no signs of abuse, we're constantly working to ensure our members' data stays protected. We appreciate the researcher responsibly reporting this and our security team will continue to stay in touch with them.

"For clarity, LinkedIn AutoFill is not broadly available and only works on whitelisted domains for approved advertisers. It allows visitors to a website to choose to pre-populate a form with information from their LinkedIn profile."

Image credit: Bigstock

Featured Resources

Top 5 challenges of migrating applications to the cloud

Explore how VMware Cloud on AWS helps to address common cloud migration challenges

Download now

3 reasons why now is the time to rethink your network

Changing requirements call for new solutions

Download now

All-flash buyer’s guide

Tips for evaluating Solid-State Arrays

Download now

Enabling enterprise machine and deep learning with intelligent storage

The power of AI can only be realised through efficient and performant delivery of data

Download now
Advertisement

Recommended

Visit/security/cyber-security/355185/165-million-britons-experienced-a-cyber-crime-in-the-past-year
cyber security

Report: 16.5 million Britons fell victim to cyber crime in the past year

1 Apr 2020
Visit/cloud/amazon-web-services-aws/355183/aws-launches-amazon-detective
Amazon Web Services (AWS)

AWS launches Amazon Detective for investigating security incidents

1 Apr 2020
Visit/security/privacy/355182/government-to-launch-coronavirus-contact-tracking-app
privacy

UK government to launch coronavirus 'contact tracking' app

1 Apr 2020
Visit/software/video-conferencing/355180/zoom-does-not-use-end-to-end-encrypted
video conferencing

Zoom admits meetings don't use end-to-end encryption

1 Apr 2020

Most Popular

Visit/security/privacy/355155/zoom-kills-facebook-integration-after-data-transfer-backlash
privacy

Zoom kills Facebook integration after data transfer backlash

30 Mar 2020
Visit/security/data-breaches/355173/marriott-hit-by-data-breach-exposing-personal-data-of-52-million
data breaches

Marriott data breach exposes personal data of 5.2 million guests

31 Mar 2020
Visit/security/cyber-crime/355171/fbi-warns-of-zoom-bombing-hackers-amidst-coronavirus-usage-spike
cyber crime

FBI warns of ‘Zoom-bombing’ hackers amid coronavirus usage spike

31 Mar 2020
Visit/data-insights/data-management/355170/oracle-cloud-courses-are-free-during-coronavirus-lockdown
data management

Oracle cloud courses are free during coronavirus lockdown

31 Mar 2020