Listen to this Post
PrivateBin is an online pastebin where the server has zero knowledge of pasted data. Prior to version 2.0.5, a reflected JSON injection vulnerability exists in the backend responses. The root cause lies in how `Request::getRequestUri()` sanitizes $_SERVER['REQUEST_URI']. The function uses FILTER_SANITIZE_URL, which does not strip characters like ", ', <, and >. As a result, the raw, attacker-controlled request URI passes through almost unmodified into Controller::$_urlBase.
In Controller::_jsonld(), `$_urlBase` is directly spliced into static `.jsonld` templates (e.g., js/types.jsonld, js/paste.jsonld) using a plain `str_replace()` without any JSON-escaping. A request URI containing a literal `”` character can therefore break out of the JSON string in the `”@context”.”pb”` value and inject arbitrary attacker-controlled key/value pairs into the response body.
The response is served with `Content-Type: application/ld+json` and Access-Control-Allow-Origin:. Additionally, the `jsonld` case in `Controller::__construct()` returns early, bypassing `_setCacheHeaders()` and all security headers normally applied in _view()—notably X-Content-Type-Options: nosniff, CSP, X-Frame-Options, and Referrer-Policy. This makes it the only response path lacking X-Content-Type-Options: nosniff.
An attacker can craft a request with a raw `”` character in the request-target (e.g., GET /?jsonld=types&x="injected":"pwned","y":" HTTP/1.1). This is typically delivered via a raw socket or HTTP client that does not normalize the request line—most browsers percent-encode `”` in the address bar, but many HTTP libraries, proxies, and automated link-preview/structured-data crawlers do not. The server reflects the raw value, producing a syntactically broken or attacker-extended JSON document.
Because `Access-Control-Allow-Origin: ` is set and `X-Content-Type-Options: nosniff` is missing on this path, any origin can fetch and rely on this manipulated content. This vulnerability is fixed in version 2.0.5. It was reported by Iaohkut and @alanturing881.
DailyCVE Form:
Platform: PrivateBin
Version: <= 2.0.4
Vulnerability: Reflected JSON Injection
Severity: Low
Date: 2026-08-28
Prediction: Already patched in 2.0.5
What Undercode Say:
Analytics & Verification Commands:
The vulnerability was dynamically confirmed on v2.0.4 (commit 597a6f0) using PHP’s built-in server:
php -S 127.0.0.1:8082 index.php
Vulnerable Request (Unpatched):
curl -v "http://127.0.0.1:8082/?jsonld=types&x=\"injected\":\"pwned\",\"y\":\""
Unpatched Response Body (excerpt):
"pb": "/?jsonld=types&x="injected":"pwned","y":"?jsonld=types"
The `”` characters are reflected raw, breaking the JSON structure. The `X-Content-Type-Options` header is absent from the response.
Patched Response Body (after fix):
"pb": "/?jsonld=types&x=\"injected\":\"pwned\",\"y\":\"?jsonld=types"
With `X-Content-Type-Options: nosniff` present.
Exploit: (Educational Purposes!)
Attack Scenario:
- Craft a raw HTTP request with unencoded double quotes in the query string:
GET /?jsonld=types&x="injected":"pwned","y":" HTTP/1.1 Host: target-privatebin.com Connection: close
- The server processes the request via `Request::getRequestUri()` using
FILTER_SANITIZE_URL, which does not strip the `”` characters.
3. `Controller::_jsonld()` splices the unsanitized `$_urlBase` into the JSON-LD template using `str_replace()` without JSON escaping. - The response body contains injected JSON key/value pairs:
"pb": "/?jsonld=types&x="injected":"pwned","y":"?jsonld=types"
- The response is served with `Content-Type: application/ld+json` and
Access-Control-Allow-Origin:, but lacksX-Content-Type-Options: nosniff. - Any origin can fetch this manipulated content, potentially exploiting structured-data consumers or less-strict clients.
Protection:
- Upgrade to PrivateBin version 2.0.5 or later.
- If unable to upgrade immediately, restrict exposure of the affected service and加强监测.
- Apply the fix that inserts only the base path in JSON API responses without GET parameters.
- Ensure `X-Content-Type-Options: nosniff` is present on all response paths.
Impact:
Reflected, unauthenticated injection of attacker-controlled content into a CORS-open `application/ld+json` response, plus a missing `X-Content-Type-Options: nosniff` header on this single response path (present everywhere else). No direct script execution was demonstrated on current browsers (this content type is generally not HTML-sniffed), but it is a real output-encoding bug (CWE-116) and a defense-in-depth gap that could be exploited by structured-data consumers or in combination with other issues or less-strict clients.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
