CVE-2024-39899: PrivateBin URL Shortening Vulnerability
Summary
CVE-2024-39899: PrivateBin allows shortening of URLs for other domains. Affects privatebin/privatebin versions >= 1.5.0, < 1.7.4. Fixed in 1.7.4. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
PrivateBin is an open-source web application that allows users to create and share encrypted pastes. It provides a secure and anonymous way to store and share sensitive information. PrivateBin supports various features, including URL shortening using the YOURLs server-side proxy. This feature allows users to shorten URLs for other domains without exposing the authentication token. However, a vulnerability in PrivateBin's URL shortening mechanism allows for the bypassing of URL restrictions, potentially leading to phishing attacks or the redirection of users to malicious websites.
Vulnerability Detail
The vulnerability in PrivateBin's URL shortening feature arises from incomplete filtering of URLs. While the guard clause checks if the PrivateBin instance is contained in the URL, it fails to verify if the URL starts with the instance. This allows an attacker to craft a URL that includes the PrivateBin instance as a GET parameter or URL fragment but does not start with the instance URL. By exploiting this vulnerability, an attacker can create shortened URLs that redirect users to arbitrary domains, potentially leading to phishing attacks or the extraction of sensitive information.
How To Fix
Minimum fixed version
1.7.4
This is the first release that contains the fix.
composer require privatebin/privatebin:1.7.4Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
To mitigate the vulnerability, users can disable URL shortening if it has been enabled. It is important to note that only the YOURLs proxy feature is affected by this vulnerability. Other URL shortening options either require a public, unauthenticated shortener or expose the token to the client, allowing the shortening of any URL.
Conclusion
The PrivateBin URL shortening vulnerability allows for the bypassing of URL restrictions, potentially leading to phishing attacks or the redirection of users to malicious websites. It is crucial for PrivateBin users to upgrade to version 1.7.4 or later to mitigate this vulnerability. Disabling URL shortening is also recommended as a workaround. PrivateBin's maintainers discourage the use of URL shorteners and emphasize the importance of sharing complete, long URLs to ensure user safety.
See every vulnerability recorded for privatebin/privatebin →
FAQ
PrivateBin is an open-source web application that allows users to create and share encrypted pastes. It provides a secure and anonymous way to store and share sensitive information.
PrivateBin's URL shortening feature utilizes the YOURLs server-side proxy. It allows users to shorten URLs for other domains without exposing the authentication token.
The vulnerability allows an attacker to create shortened URLs that redirect users to arbitrary domains. This can be exploited for phishing campaigns or to extract sensitive information from unsuspecting users.
The vulnerability has been patched in version 1.7.4 of PrivateBin. It is recommended to upgrade to this version or later. Additionally, users can disable URL shortening if it has been enabled.
Disabling URL shortening is a viable workaround for users who have been utilizing this feature. It is important to note that only the YOURLs proxy feature is affected by this vulnerability.
References
Related vulnerabilities
Recent vulnerabilities recorded for privatebin/privatebin.
