cvelistv5 - cve-2024-39899

CVE-2024-39899 (GCVE-0-2024-39899)

Vulnerability from cvelistv5

Published

2024-07-09 18:57

Modified

2024-08-02 04:33

Severity ?

5.3 (Medium) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

CWE

CWE-305 - Authentication Bypass by Primary Weakness
CWE-791 - Incomplete Filtering of Special Elements

Summary

PrivateBin is an online pastebin where the server has zero knowledge of pasted data. In v1.5, PrivateBin introduced the YOURLS server-side proxy. The idea was to allow using the YOURLs URL shortener without running the YOURLs instance without authentication and/or exposing the authentication token to the public, allowing anyone to shorten any URL. With the proxy mechanism, anyone can shorten any URL pointing to the configured PrivateBin instance. The vulnerability allowed other URLs to be shortened, as long as they contain the PrivateBin instance, defeating the limit imposed by the proxy. This vulnerability is fixed in 1.7.4.

References

►

URL

Tags

	security-advisories@github.com	https://github.com/PrivateBin/PrivateBin/commit/0c4e810e6728f67d678458838d8430dfba4fcca4
	security-advisories@github.com	https://github.com/PrivateBin/PrivateBin/pull/1370
	security-advisories@github.com	https://github.com/PrivateBin/PrivateBin/security/advisories/GHSA-mqqj-fx8h-437j
	af854a3a-2127-422b-91ae-364da2661108	https://github.com/PrivateBin/PrivateBin/commit/0c4e810e6728f67d678458838d8430dfba4fcca4
	af854a3a-2127-422b-91ae-364da2661108	https://github.com/PrivateBin/PrivateBin/pull/1370
	af854a3a-2127-422b-91ae-364da2661108	https://github.com/PrivateBin/PrivateBin/security/advisories/GHSA-mqqj-fx8h-437j

Impacted products

	Vendor	Product	Version
	PrivateBin	PrivateBin	Version: >= 1.5.0, < 1.7.4

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:a:privatebin:privatebin:1.5.0:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "privatebin",
            "vendor": "privatebin",
            "versions": [
              {
                "lessThan": "1.7.4",
                "status": "affected",
                "version": "1.5.0",
                "versionType": "custom"
              }
            ]
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-39899",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-07-10T14:31:16.074596Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-07-10T14:35:40.992Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T04:33:11.967Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "https://github.com/PrivateBin/PrivateBin/security/advisories/GHSA-mqqj-fx8h-437j",
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://github.com/PrivateBin/PrivateBin/security/advisories/GHSA-mqqj-fx8h-437j"
          },
          {
            "name": "https://github.com/PrivateBin/PrivateBin/pull/1370",
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/PrivateBin/PrivateBin/pull/1370"
          },
          {
            "name": "https://github.com/PrivateBin/PrivateBin/commit/0c4e810e6728f67d678458838d8430dfba4fcca4",
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/PrivateBin/PrivateBin/commit/0c4e810e6728f67d678458838d8430dfba4fcca4"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "PrivateBin",
          "vendor": "PrivateBin",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 1.5.0, \u003c 1.7.4"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "PrivateBin is an online pastebin where the server has zero knowledge of pasted data. In v1.5, PrivateBin introduced the YOURLS server-side proxy. The idea was to allow using the YOURLs URL shortener without running the YOURLs instance without authentication and/or exposing the authentication token to the public, allowing anyone to shorten any URL. With the proxy mechanism, anyone can shorten any URL pointing to the configured PrivateBin instance. The vulnerability allowed other URLs to be shortened, as long as they contain the PrivateBin instance, defeating the limit imposed by the proxy. This vulnerability is fixed in 1.7.4."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-305",
              "description": "CWE-305: Authentication Bypass by Primary Weakness",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-791",
              "description": "CWE-791: Incomplete Filtering of Special Elements",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-07-09T18:57:50.228Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/PrivateBin/PrivateBin/security/advisories/GHSA-mqqj-fx8h-437j",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/PrivateBin/PrivateBin/security/advisories/GHSA-mqqj-fx8h-437j"
        },
        {
          "name": "https://github.com/PrivateBin/PrivateBin/pull/1370",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/PrivateBin/PrivateBin/pull/1370"
        },
        {
          "name": "https://github.com/PrivateBin/PrivateBin/commit/0c4e810e6728f67d678458838d8430dfba4fcca4",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/PrivateBin/PrivateBin/commit/0c4e810e6728f67d678458838d8430dfba4fcca4"
        }
      ],
      "source": {
        "advisory": "GHSA-mqqj-fx8h-437j",
        "discovery": "UNKNOWN"
      },
      "title": "PrivateBin allows shortening of URLs for other domains"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2024-39899",
    "datePublished": "2024-07-09T18:57:50.228Z",
    "dateReserved": "2024-07-02T19:37:18.599Z",
    "dateUpdated": "2024-08-02T04:33:11.967Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-39899\",\"sourceIdentifier\":\"security-advisories@github.com\",\"published\":\"2024-07-09T19:15:13.160\",\"lastModified\":\"2024-11-21T09:28:31.470\",\"vulnStatus\":\"Awaiting Analysis\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"PrivateBin is an online pastebin where the server has zero knowledge of pasted data. In v1.5, PrivateBin introduced the YOURLS server-side proxy. The idea was to allow using the YOURLs URL shortener without running the YOURLs instance without authentication and/or exposing the authentication token to the public, allowing anyone to shorten any URL. With the proxy mechanism, anyone can shorten any URL pointing to the configured PrivateBin instance. The vulnerability allowed other URLs to be shortened, as long as they contain the PrivateBin instance, defeating the limit imposed by the proxy. This vulnerability is fixed in 1.7.4.\"},{\"lang\":\"es\",\"value\":\"PrivateBin es un pastbin en l\u00ednea donde el servidor no tiene conocimiento de los datos pegados. En v1.5, PrivateBin introdujo el proxy del lado del servidor YOURLS. La idea era permitir el uso del acortador de URL de YOURLs sin ejecutar la instancia de YOURLs sin autenticaci\u00f3n y/o exponer el token de autenticaci\u00f3n al p\u00fablico, permitiendo a cualquiera acortar cualquier URL. Con el mecanismo de proxy, cualquiera puede acortar cualquier URL que apunte a la instancia de PrivateBin configurada. La vulnerabilidad permiti\u00f3 acortar otras URL, siempre que contengan la instancia PrivateBin, anulando el l\u00edmite impuesto por el proxy. Esta vulnerabilidad se solucion\u00f3 en 1.7.4.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N\",\"baseScore\":5.3,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"LOW\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":3.9,\"impactScore\":1.4}]},\"weaknesses\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-305\"},{\"lang\":\"en\",\"value\":\"CWE-791\"}]}],\"references\":[{\"url\":\"https://github.com/PrivateBin/PrivateBin/commit/0c4e810e6728f67d678458838d8430dfba4fcca4\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/PrivateBin/PrivateBin/pull/1370\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/PrivateBin/PrivateBin/security/advisories/GHSA-mqqj-fx8h-437j\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/PrivateBin/PrivateBin/commit/0c4e810e6728f67d678458838d8430dfba4fcca4\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://github.com/PrivateBin/PrivateBin/pull/1370\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://github.com/PrivateBin/PrivateBin/security/advisories/GHSA-mqqj-fx8h-437j\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"}]}}",
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://github.com/PrivateBin/PrivateBin/security/advisories/GHSA-mqqj-fx8h-437j\", \"name\": \"https://github.com/PrivateBin/PrivateBin/security/advisories/GHSA-mqqj-fx8h-437j\", \"tags\": [\"x_refsource_CONFIRM\", \"x_transferred\"]}, {\"url\": \"https://github.com/PrivateBin/PrivateBin/pull/1370\", \"name\": \"https://github.com/PrivateBin/PrivateBin/pull/1370\", \"tags\": [\"x_refsource_MISC\", \"x_transferred\"]}, {\"url\": \"https://github.com/PrivateBin/PrivateBin/commit/0c4e810e6728f67d678458838d8430dfba4fcca4\", \"name\": \"https://github.com/PrivateBin/PrivateBin/commit/0c4e810e6728f67d678458838d8430dfba4fcca4\", \"tags\": [\"x_refsource_MISC\", \"x_transferred\"]}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2024-08-02T04:33:11.967Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-39899\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"yes\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-07-10T14:31:16.074596Z\"}}}], \"affected\": [{\"cpes\": [\"cpe:2.3:a:privatebin:privatebin:1.5.0:*:*:*:*:*:*:*\"], \"vendor\": \"privatebin\", \"product\": \"privatebin\", \"versions\": [{\"status\": \"affected\", \"version\": \"1.5.0\", \"lessThan\": \"1.7.4\", \"versionType\": \"custom\"}], \"defaultStatus\": \"unknown\"}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-07-10T14:33:36.770Z\"}}], \"cna\": {\"title\": \"PrivateBin allows shortening of URLs for other domains\", \"source\": {\"advisory\": \"GHSA-mqqj-fx8h-437j\", \"discovery\": \"UNKNOWN\"}, \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 5.3, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"MEDIUM\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N\", \"integrityImpact\": \"LOW\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"NONE\", \"privilegesRequired\": \"NONE\", \"confidentialityImpact\": \"NONE\"}}], \"affected\": [{\"vendor\": \"PrivateBin\", \"product\": \"PrivateBin\", \"versions\": [{\"status\": \"affected\", \"version\": \"\u003e= 1.5.0, \u003c 1.7.4\"}]}], \"references\": [{\"url\": \"https://github.com/PrivateBin/PrivateBin/security/advisories/GHSA-mqqj-fx8h-437j\", \"name\": \"https://github.com/PrivateBin/PrivateBin/security/advisories/GHSA-mqqj-fx8h-437j\", \"tags\": [\"x_refsource_CONFIRM\"]}, {\"url\": \"https://github.com/PrivateBin/PrivateBin/pull/1370\", \"name\": \"https://github.com/PrivateBin/PrivateBin/pull/1370\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://github.com/PrivateBin/PrivateBin/commit/0c4e810e6728f67d678458838d8430dfba4fcca4\", \"name\": \"https://github.com/PrivateBin/PrivateBin/commit/0c4e810e6728f67d678458838d8430dfba4fcca4\", \"tags\": [\"x_refsource_MISC\"]}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"PrivateBin is an online pastebin where the server has zero knowledge of pasted data. In v1.5, PrivateBin introduced the YOURLS server-side proxy. The idea was to allow using the YOURLs URL shortener without running the YOURLs instance without authentication and/or exposing the authentication token to the public, allowing anyone to shorten any URL. With the proxy mechanism, anyone can shorten any URL pointing to the configured PrivateBin instance. The vulnerability allowed other URLs to be shortened, as long as they contain the PrivateBin instance, defeating the limit imposed by the proxy. This vulnerability is fixed in 1.7.4.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-305\", \"description\": \"CWE-305: Authentication Bypass by Primary Weakness\"}]}, {\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-791\", \"description\": \"CWE-791: Incomplete Filtering of Special Elements\"}]}], \"providerMetadata\": {\"orgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"shortName\": \"GitHub_M\", \"dateUpdated\": \"2024-07-09T18:57:50.228Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-39899\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2024-08-02T04:33:11.967Z\", \"dateReserved\": \"2024-07-02T19:37:18.599Z\", \"assignerOrgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"datePublished\": \"2024-07-09T18:57:50.228Z\", \"assignerShortName\": \"GitHub_M\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}

fkie_cve-2024-39899

Vulnerability from fkie_nvd

Published

2024-07-09 19:15

Modified

2024-11-21 09:28

Severity ?

5.3 (Medium) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Summary

References

▶	URL	Tags
	security-advisories@github.com	https://github.com/PrivateBin/PrivateBin/commit/0c4e810e6728f67d678458838d8430dfba4fcca4
	security-advisories@github.com	https://github.com/PrivateBin/PrivateBin/pull/1370
	security-advisories@github.com	https://github.com/PrivateBin/PrivateBin/security/advisories/GHSA-mqqj-fx8h-437j
	af854a3a-2127-422b-91ae-364da2661108	https://github.com/PrivateBin/PrivateBin/commit/0c4e810e6728f67d678458838d8430dfba4fcca4
	af854a3a-2127-422b-91ae-364da2661108	https://github.com/PrivateBin/PrivateBin/pull/1370
	af854a3a-2127-422b-91ae-364da2661108	https://github.com/PrivateBin/PrivateBin/security/advisories/GHSA-mqqj-fx8h-437j

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "PrivateBin is an online pastebin where the server has zero knowledge of pasted data. In v1.5, PrivateBin introduced the YOURLS server-side proxy. The idea was to allow using the YOURLs URL shortener without running the YOURLs instance without authentication and/or exposing the authentication token to the public, allowing anyone to shorten any URL. With the proxy mechanism, anyone can shorten any URL pointing to the configured PrivateBin instance. The vulnerability allowed other URLs to be shortened, as long as they contain the PrivateBin instance, defeating the limit imposed by the proxy. This vulnerability is fixed in 1.7.4."
    },
    {
      "lang": "es",
      "value": "PrivateBin es un pastbin en l\u00ednea donde el servidor no tiene conocimiento de los datos pegados. En v1.5, PrivateBin introdujo el proxy del lado del servidor YOURLS. La idea era permitir el uso del acortador de URL de YOURLs sin ejecutar la instancia de YOURLs sin autenticaci\u00f3n y/o exponer el token de autenticaci\u00f3n al p\u00fablico, permitiendo a cualquiera acortar cualquier URL. Con el mecanismo de proxy, cualquiera puede acortar cualquier URL que apunte a la instancia de PrivateBin configurada. La vulnerabilidad permiti\u00f3 acortar otras URL, siempre que contengan la instancia PrivateBin, anulando el l\u00edmite impuesto por el proxy. Esta vulnerabilidad se solucion\u00f3 en 1.7.4."
    }
  ],
  "id": "CVE-2024-39899",
  "lastModified": "2024-11-21T09:28:31.470",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 5.3,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "NONE",
          "integrityImpact": "LOW",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 1.4,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ]
  },
  "published": "2024-07-09T19:15:13.160",
  "references": [
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/PrivateBin/PrivateBin/commit/0c4e810e6728f67d678458838d8430dfba4fcca4"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/PrivateBin/PrivateBin/pull/1370"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/PrivateBin/PrivateBin/security/advisories/GHSA-mqqj-fx8h-437j"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://github.com/PrivateBin/PrivateBin/commit/0c4e810e6728f67d678458838d8430dfba4fcca4"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://github.com/PrivateBin/PrivateBin/pull/1370"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://github.com/PrivateBin/PrivateBin/security/advisories/GHSA-mqqj-fx8h-437j"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Awaiting Analysis",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-305"
        },
        {
          "lang": "en",
          "value": "CWE-791"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Secondary"
    }
  ]
}

ghsa-mqqj-fx8h-437j

Vulnerability from github

Published

2024-07-10 14:25

Modified

2024-07-12 13:22

Severity ?

5.3 (Medium) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
6.9 (Medium) - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Summary

PrivateBin allows shortening of URLs for other domains

Details

In v1.5 we introduced the YOURLS server-side proxy. The idea was to allow using the YOURLs URL shortener without running the YOURLs instance without authentication and/or exposing the authentication token to the public, allowing anyone to shorten any URL. With the proxy mechanism, anyone can shorten any URL pointing to the configured PrivateBin instance. The vulnerability allowed other URLs to be shortened, as long as they contain the PrivateBin instance, defeating the limit imposed by the proxy.

Neither the confidentially of existing pastes on the server nor the configuration options including the YOURLs token are affected.

Impact

This issue only affects non-standard configurations of PrivateBin. Instances are affected if all of the following conditions are met: 1. The PrivateBin instance enables URL shortening. 2. A YOURLs URL shortener is used and it is configured not to be public and require authentication to shorten URLs. 3. A basepath, the YOURLs proxy mechanism and an authentication token is configured in PrivateBin to use the non-public YOURLs instance. 4. A crafted URL is sent to PrivateBins' YOURLs proxy endpoint with a URL that contains the PrivateBin instance URL as a GET-parameter or as part of the URL-fragment, but doesn't start with the instance URL (a third-party URL)

The root cause is, that the guard clause checking whether the URL to be shortened belongs to your own PrivateBin domain only checks if the PrivateBin instance is contained in the URL but not if it starts with it.

This is a kind of authentication bypass due to incomplete filtering. This has a similar impact like an open redirect except it does not directly redirect, but allows a further hiding of the target URL as is common and known for URL shorteners. If the URL shortener domain used is trusted by it's users, this allows hiding a malicious URL.

The highest impact may be that this can be used for phishing campaigns, by routing users to some kind of fake site mimicking the trusted shortener or PrivateBin domain, which could then extract sensitive data from entered data or similar. That said, this is a general concern with URL shorteners and users are advised to follow general phishing prevention attempts like verifying the domain of the site they are using and using a trusted PrivateBin instance.

Indicators of exploitation

Check your YOURLs proxy for shortened domains that do not start with your own PrivateBin instance. Also note, that for this to be a result of an exploitation of this vulnerability, somewhere in the URL the base path + ? e.g. https://privatebin.example/? has to appear in the destination URL, as this is what the guard checked for.

Patches

The problem has been patched in version 1.7.4 of PrivateBin. In addition to upgrading, users of the YOURLs proxy feature should check for the indicators of exploitation, as outlined above.

Workarounds

Disable URL shortening, if you have been using it.
Only the YOURLs proxy is affected. Other URL shortening options either require a public, un-authenticated shortener, or expose the token to the client, which by design allows shortening any URL.

Proof of concept

See the unit test that got introduced to prevent similar regressions for an example of a URL that would circumvent the configured basepath.

Here is an example of how a manual exploitation would work:

In a PrivateBin instance hosted on https://privatebin.example/, with a valid URL YOURLs shortening proxy configuration using a token to prevent un-authenticated short-URL creation, send a URL shortening request for the domain https://attacker.example.com/?q=https://privatebin.example/?foo#bar. attacker.example.com is any attacker controlled, arbitrary domain.

You can do this by sending a GET request to https://privatebin.example/shortenviayourls?link=https%3A%2F%2Fattacker.example.com%2F%3Fq%3Dhttps%3A%2F%2Fprivatebin.example%2F%3Ffoo%23bar, without URL encoding this looks as follows: https://privatebin.example/shortenviayourls?link=https://attacker.example.com/?q=https://privatebin.example/?foo#bar.

On an affected setup, you will get a valid short URL, which when accessed, leads to https://attacker.example.com/?foo#bar, the attackers domain. On a patched system your request will get rejected and only URLs starting with https://privatebin.example/?[...] are allowed for shortening.

Post-mortem

From our limited analysis, the issue has been introduced in commit 0dc9ab7 while refactoring. The use of substr got replaced by strpos. The initial contribution contained no tests, but an implementation without this flaw. All these changes got introduced in a single pull request. This follows many best practices, as tests were added and the refactoring was done in close collaboration with the original author.

In the future, we plan to switch to the more obvious, readable and understandable str_starts_with, which is available since PHP v8. Such a better function naming and insisting on using modern functions would not only result in a better code quality, but would possibly have prevented the issue, but for backwards-compatibility with PHP 7.3, we stay on the old function for now.

Final Thoughts

The project maintainers have always discouraged the use of URL shorteners and users are always safer sharing the complete, long URL to a paste, see our FAQ.

If you need or want to provide a URL shortener option as a PrivateBin instance administrator, YOURLs is the best option available to use with PrivateBin, because it is the only shortener supported, through the proxy mechanism, preventing arbitrarily shortening any URLs. Running a public URL shortener instance and allowing anonymous users shortening arbitrary domains invites the shortener getting abused.

References

PR to fix the vulnerability: https://github.com/PrivateBin/PrivateBin/pull/1370

Timeline

2024-06-28 Issue report by @nbxiglk via email
2024-06-29 Vulnerability reproduced by @elrido, mitigation created and shared with maintainers and issue reporter for review
2024-07-06 Pull request with mitigation raised

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "Packagist",
        "name": "privatebin/privatebin"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "1.5.0"
            },
            {
              "fixed": "1.7.4"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2024-39899"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-305",
      "CWE-791"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2024-07-10T14:25:23Z",
    "nvd_published_at": "2024-07-09T19:15:13Z",
    "severity": "MODERATE"
  },
  "details": "In [v1.5](https://github.com/PrivateBin/PrivateBin/blob/master/CHANGELOG.md#15-2022-12-11) we introduced the YOURLS server-side proxy. The idea was to allow using the YOURLs URL shortener without running the YOURLs instance without authentication and/or exposing the authentication token to the public, allowing anyone to shorten any URL. With the proxy mechanism, anyone can shorten any URL pointing to the configured PrivateBin instance. The vulnerability allowed other URLs to be shortened, as long as they contain the PrivateBin instance, defeating the limit imposed by the proxy.\n\nNeither the confidentially of existing pastes on the server nor the configuration options including the YOURLs token are affected.\n\n### Impact\n\nThis issue only affects non-standard configurations of PrivateBin. Instances are affected if all of the following conditions are met:\n1. The PrivateBin instance enables URL shortening.\n2. A YOURLs URL shortener is used and it is configured not to be public and require authentication to shorten URLs.\n3. A basepath, the YOURLs proxy mechanism and an authentication token is  configured in PrivateBin to use the non-public YOURLs instance.\n4. A crafted URL is sent to PrivateBins\u0027 YOURLs proxy endpoint with a URL that contains the PrivateBin instance URL as a GET-parameter or as part of the URL-fragment, but doesn\u0027t start with the instance URL (a third-party URL)\n\nThe root cause is, [that the guard clause checking whether the URL to be shortened belongs to your own PrivateBin domain only checks if the PrivateBin instance is contained in the URL](https://github.com/PrivateBin/PrivateBin/blob/3cba170f3255de21bbebb77f6c565519ef33e8c1/lib/YourlsProxy.php#L50-L53) but not if it starts with it.\n\nThis is a kind of authentication bypass due to incomplete filtering. This [has a similar impact like an open redirect](https://cwe.mitre.org/data/definitions/601.html) except it does not directly redirect, but allows a further hiding of the target URL as is common and known for URL shorteners. If the URL shortener domain used is trusted by it\u0027s users, this allows hiding a malicious URL. \n\nThe highest impact may be that this can be used for phishing campaigns, by routing users to some kind of fake site mimicking the trusted shortener or PrivateBin domain, which could then extract sensitive data from entered data or similar. That said, this is a general concern with URL shorteners and users are advised to follow general phishing prevention attempts like verifying the domain of the site they are using and [using a trusted PrivateBin instance](https://github.com/PrivateBin/PrivateBin?tab=readme-ov-file#what-it-doesnt-provide).\n\n### Indicators of exploitation\n\nCheck your YOURLs proxy for shortened domains that do not start with your own PrivateBin instance. Also note, that for this to be a result of an exploitation of this vulnerability, somewhere in the URL the `base path + ?` e.g. `https://privatebin.example/?` has to appear in the destination URL, as this is what the guard checked for.\n\n### Patches\n\nThe problem has been patched in version 1.7.4 of PrivateBin. In addition to upgrading, users of the YOURLs proxy feature should check for the indicators of exploitation, as outlined above.\n\n### Workarounds\n\n* Disable URL shortening, if you have been using it.\n* Only the YOURLs proxy is affected. Other URL shortening options either require a public, un-authenticated shortener, or expose the token to the client, which by design allows shortening any URL.\n\n### Proof of concept\n\nSee [the unit test that got introduced](https://github.com/PrivateBin/PrivateBin/blob/2c711e9d3ca21230fc68f5b4dba2a7a0592b963b/tst/YourlsProxyTest.php#L57-L62) to prevent similar regressions for an example of a URL that would circumvent the configured basepath.\n\nHere is an example of how a manual exploitation would work:\n\nIn a PrivateBin instance hosted on `https://privatebin.example/`, with a valid URL YOURLs shortening proxy configuration using a token to prevent un-authenticated short-URL creation, send a URL shortening request for the domain `https://attacker.example.com/?q=https://privatebin.example/?foo#bar`. `attacker.example.com` is any attacker controlled, arbitrary domain.\n\nYou can do this by sending a GET request to `https://privatebin.example/shortenviayourls?link=https%3A%2F%2Fattacker.example.com%2F%3Fq%3Dhttps%3A%2F%2Fprivatebin.example%2F%3Ffoo%23bar`, without URL encoding this looks as follows: `https://privatebin.example/shortenviayourls?link=https://attacker.example.com/?q=https://privatebin.example/?foo#bar`.\n\nOn an affected setup, you will get a valid short URL, which when accessed, leads to `https://attacker.example.com/?foo#bar`, the attackers domain. On a patched system your request will get rejected and only URLs starting with `https://privatebin.example/?[...]` are allowed for shortening.\n\n### Post-mortem\n\nFrom our limited analysis, the issue [has been introduced in commit `0dc9ab7` while refactoring](https://github.com/PrivateBin/PrivateBin/commit/0dc9ab7576d5a1296debeb788afb2ae9c72d137c). The use of [`substr`](http://php.net/manual/function.substr.php) got replaced by [`strpos`](https://www.php.net/manual/function.strpos). The [initial contribution](https://github.com/PrivateBin/PrivateBin/commit/b0f17f0a91cdebbfd6732781943f1e04ce3311f7) contained no tests, but an implementation without this flaw. All these changes got introduced [in a single pull request](https://github.com/PrivateBin/PrivateBin/pull/997). This follows many best practices, as tests were added and the refactoring was done in close collaboration with the original author.\n\nIn the future, [we plan to switch to the more obvious, readable and understandable](https://github.com/PrivateBin/PrivateBin/issues/1373) [`str_starts_with`](https://www.php.net/manual/function.str-starts-with.php), which is available since PHP v8. Such a better function naming and insisting on using modern functions would not only result in a better code quality, but would possibly have prevented the issue, but for backwards-compatibility with PHP 7.3, we stay on the old function for now.\n\n### Final Thoughts\n\nThe project maintainers have always discouraged the use of URL shorteners and **users are always safer sharing the complete, long URL to a paste**, see [our FAQ](https://github.com/PrivateBin/PrivateBin/wiki/FAQ#the-url-is-so-long-cant-i-just-use-an-url-shortener).\n\nIf you need or want to provide a URL shortener option as a PrivateBin instance administrator, YOURLs is the _best option_ available to use with PrivateBin, because it is the only shortener supported, through the proxy mechanism, preventing arbitrarily shortening any URLs. Running a public URL shortener instance and allowing anonymous users shortening arbitrary domains invites the shortener getting abused.\n\n### References\n\n* PR to fix the vulnerability: https://github.com/PrivateBin/PrivateBin/pull/1370\n\n### Timeline\n\n- 2024-06-28 Issue report by @nbxiglk via email\n- 2024-06-29 Vulnerability reproduced by @elrido, mitigation created and shared with maintainers and issue reporter for review\n- 2024-07-06 Pull request with mitigation raised",
  "id": "GHSA-mqqj-fx8h-437j",
  "modified": "2024-07-12T13:22:14Z",
  "published": "2024-07-10T14:25:23Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/PrivateBin/PrivateBin/security/advisories/GHSA-mqqj-fx8h-437j"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-39899"
    },
    {
      "type": "WEB",
      "url": "https://github.com/PrivateBin/PrivateBin/pull/1370"
    },
    {
      "type": "WEB",
      "url": "https://github.com/PrivateBin/PrivateBin/commit/0c4e810e6728f67d678458838d8430dfba4fcca4"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/PrivateBin/PrivateBin"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "PrivateBin allows shortening of URLs for other domains"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.

Action not permitted

CVE-2024-39899 (GCVE-0-2024-39899)

Vulnerability from cvelistv5

fkie_cve-2024-39899

Vulnerability from fkie_nvd

ghsa-mqqj-fx8h-437j

Vulnerability from github

Impact

Indicators of exploitation

Patches

Workarounds

Proof of concept

Post-mortem

Final Thoughts

References

Timeline

Tags

Sightings

Nomenclature