YOURLS 1.8.2: Logout Laughter with a CSRF Vulnerability
Welcome to the world of YOURLS 1.8.2, where logging out is now easier than ever—just visit a page! Thanks to a Cross-Site Request Forgery (CSRF) vulnerability, you can be logged out without lifting a finger, or consenting! It’s like a magician’s disappearing act, but for your online session. CVE-2022-0088 strikes again!
Hot Take:
Looks like YOURLS just YOURLS-ed itself! The latest CSRF vulnerability in YOURLS 1.8.2 is like a digital whoopee cushion, tricking unsuspecting users into logging themselves out faster than you can say “security patch!”
Key Points:
- YOURLS 1.8.2 is vulnerable to a Cross-Site Request Forgery (CSRF) attack.
- The vulnerability could log out authenticated users without their consent.
- Exploit involves a simple HTML page acting as a “poof” button for unsuspecting users.
- This issue has been assigned the CVE identifier CVE-2022-0088.
- The exploit was tested on Windows, but it can potentially impact other platforms too.
Already a member? Log in here