CVE-2021-3734: Improper Restriction of Rendered UI Layers or Frames in yourls
Summary
CVE-2021-3734: Improper Restriction of Rendered UI Layers or Frames in yourls. Affects yourls/yourls versions < 1.8.1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
yourls is a package available on Packagist that provides a URL shortening service. It allows users to create custom short URLs and track their usage. The package is widely used for creating URL shortening services and is an essential component of many applications. However, the package is vulnerable to an issue that can lead to improper restriction of rendered UI layers or frames.
Vulnerability Detail
The vulnerability in yourls arises from a lack of proper restriction of rendered UI layers or frames. This can allow an attacker to load the yourls application within an iframe on a malicious website, potentially leading to various attacks. The impact of this vulnerability can range from clickjacking attacks to phishing attempts, depending on the attacker's intentions. The vulnerability has a CVSS score of 6.5, indicating a moderate severity level.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
If updating yourls is not immediately feasible, a temporary workaround is to implement a Content Security Policy (CSP) that restricts the loading of yourls within iframes. By setting the 'frame-ancestors' directive in the CSP header to 'none', you can prevent yourls from being loaded within iframes. Here is an example of how to set the CSP header in PHP:
header('Content-Security-Policy: frame-ancestors 'none'');
Implementing this workaround will provide an additional layer of protection until you can update yourls to a patched version.
Conclusion
In conclusion, yourls is vulnerable to an improper restriction of rendered UI layers or frames. This vulnerability can be mitigated by updating yourls to version 1.8.2 or later. If immediate updating is not possible, implementing a Content Security Policy (CSP) can provide a temporary workaround. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for yourls/yourls →
FAQ
yourls is a package that provides a URL shortening service. It allows users to create custom short URLs and track their usage.
The vulnerability allows an attacker to load the yourls application within an iframe on a malicious website, potentially leading to clickjacking attacks or phishing attempts.
The vulnerability has a CVSS score of 6.5, indicating a moderate severity level.
To fix this vulnerability, update yourls to version 1.8.2 or later. This version includes a patch that addresses the vulnerability.
Yes, you can implement a Content Security Policy (CSP) that restricts the loading of yourls within iframes. Setting the 'frame-ancestors' directive in the CSP header to 'none' will prevent yourls from being loaded within iframes.
Related vulnerabilities
Recent vulnerabilities recorded for yourls/yourls.
