# Entire database of emails exposed through URN injection

LinkedIn Voyager decoration expansion resolved arbitrary URNs placed in profile text fields, letting an attacker enumerate sequential email IDs and dump the email database.

- Payout: hidden
- Severity: medium
- Program: LinkedIn
- Found by: ultrapowa
- Disclosed: 2023-05-22
- Write-up quality: 8/10
- Original: https://hackerone.com/reports/1806939
- Library page: https://bugbountylibrary.com/r/h1%3A1806939
- Tags: area:web domain:api impact:data-leak impact:pii-leak kind:bounty platform:hackerone sev:medium tech:rest technique:source-review vuln:access-control vuln:idor vuln:info-disclosure

**Target:** Voyager REST API decoration/URN resolution (www.linkedin.com)
**Root cause:** The Voyager query engine does not restrict which fields may be expanded via decoration, and URN resolution of emailAddress entities lacks an access check, so any text field containing a urn:li:fs_emailAddress value resolves to the victim's email.
**Steps:**
1. Authenticate to linkedin.com and edit profile contact info, adding a website URL set to `urn:li:fs_emailAddress:8519272224`
2. Send `GET https://www.linkedin.com/voyager/api/identity/dash/profiles?decoration=%28websites*%28url~%29%29&memberIdentity=[public identifier]&q=memberIdentity` with headers `accept: application/vnd.linkedin.normalized+json+2.1`, `csrf-token: ajax:[token]`, `x-li-deco-include-micro-schema: true`
3. Observe the `included` array contains an EmailAddress entity with the resolved email for the injected URN
4. Iterate the sequential email id in the URN to enumerate other users' emails
**How found:** Noticed the decoration feature lets anyone expand URN fields, hypothesized the query engine doesn't validate expandability per field, and tested placing a urn:li:fs_emailAddress value in a text field to force resolution.
**Exploitation:** Attacker stores a crafted URN in an expandable text field (website URL) on their own profile, then issues a decoration query that expands that field, causing server-side URN resolution to fetch the referenced emailAddress entity and return it in the response. Sequential email IDs allow mass enumeration.
**Escalation:** Arrays and multiple accounts could scale retrieval to millions of emails per day.
**Insight:** When an API exposes a generic 'expand/decoration' mechanism keyed by URNs, test whether user-controlled string fields are treated as URNs and resolved server-side without per-field allowlisting or authorization checks.