Attack Chain

1. An unauthenticated attacker crafts an HTTP request containing a malicious 'Referer' header (e.g., "http://x',1],['marker',alert(1)],['z.tld/path").
2. The attacker triggers a request for an existing short URL on the target YOURLS instance using the crafted 'Referer' header.
3. The yourls_log_redirect function processes the request and stores the unsanitized (but truncated) 'Referer' header in the application's database.
4. An authenticated administrator navigates to the statistics page (e.g., <keyword>+) for the targeted short URL.
5. The application extracts the domain from the logged referrers and passes it to yourls_stats_pie.
6. The yourls_google_array_to_data_table function concatenates the malicious referrer domain directly into the Google Charts JavaScript array without sanitization.
7. The administrator's browser executes the injected JavaScript payload within the session context.
8. The attacker uses the privileged session to perform actions such as creating/deleting links, modifying destinations, or stealing API tokens.

Impact

Successful exploitation results in arbitrary JavaScript execution within the authenticated session of a YOURLS administrator. An attacker can use this access to perform privileged actions, including modifying or deleting existing short-link destinations to facilitate phishing or malware distribution, and accessing sensitive administrative tools. Furthermore, the XSS can be used to extract the administrative API signature token from /admin/tools.php, allowing for persistent, passwordless API access to the YOURLS instance until the secret is rotated.

Recommendation

Prioritize upgrading all YOURLS instances to a patched version that correctly escapes JavaScript string metacharacters in the statistics generation logic. Until an upgrade can be performed, monitor web server logs for suspicious 'Referer' headers containing characters indicative of XSS attempts, such as single quotes, square brackets, or parentheses. If logs reveal evidence of attempted exploitation, rotate administrative API tokens immediately and audit the current short-link inventory for unauthorized modifications.