LinkedIn Oncall 1.4.0 XSS

Description

LinkedIn Oncall is the on-call management and scheduling system at LinkedIn. It offers highly customizable scheduling for on-call shifts, as well as a streamlined UI for editing, swapping, and overriding on-call shifts.

LinkedIn Oncall through 1.4.0 allows reflected XSS via /query because of mishandling of the “No results found for” message in the search bar.

Impact

• If attackers can control the script which is executed in the victim’s browser, by intentionally installing RAT, then the attacker can fully compromise that user’s device

• Attackers can change any information that the user is able to change

• Attackers can display any information that the user is able to do

• Attackers can perform any action on the user’s behalf

Recommendation

• Update LinkedIn Oncall to the latest version.

Written by

Anandhu Krishnan

Lead Engineer

Anandhu is an accomplished Senior Lead Engineer with a strong focus on back-end development. His expertise lies in architecting and optimizing the core of software applications to ensure they run smoothly and efficiently. With a meticulous attention to detail and a deep understanding of data management and server-side operations, Anandhu has been a driving force behind the success of various back-end projects.