CVE-2019-14537: YOURLS type juggling login bypass in API

Executive brief

YOURLS, a popular self-hosted URL shortening service, contains a security flaw in its API component. An attacker can exploit this to bypass the login process and gain unauthorized access to the system. This could allow an unauthorized user to manage links, view statistics, or modify system settings, potentially leading to a full compromise of the service.

Technical details

A type juggling (type confusion) vulnerability exists in the API authentication component of YOURLS through version 1.7.3. The flaw stems from the use of loose comparison operators in PHP when validating authentication tokens or credentials against expected types. A remote, unauthenticated attacker can exploit this by providing specially crafted input that PHP evaluates as a match, effectively bypassing the login requirement. Successful exploitation grants the attacker full access to API functionality. This issue is resolved in version 1.7.4.

Affected products

• YOURLS YOURLS <= 1.7.3

Timeline

• 2019-09-23: advisory
• 2019-09-22: patched: Version 1.7.4 released

References

• https://api.github.com/users/LeoColomb
• https://github.com/LeoColomb
• https://api.github.com/users/LeoColomb/gists%7B/gist_id%7D
• https://api.github.com/users/LeoColomb/repos
• https://avatars.githubusercontent.com/u/846943?v=4
• https://api.github.com/users/LeoColomb/events%7B/privacy%7D