Threat Intelligence Database

Shlink versions 5.0.0 through 5.1.5 have a CSV formula injection vulnerability that allows unauthenticated attackers to inject malicious spreadsheet formulas into exported visit data. This occurs when attackers supply values starting with formula-triggering characters in HTTP headers or request paths. When an administrator opens the exported CSV file in a spreadsheet software that evaluates formulas, these malicious formulas can execute.

Shlink contains a blind SQL injection vulnerability that allows any authenticated API key holder to inject arbitrary SQL fragments by supplying an unvalidated direction value in the orderBy query parameter of the tag statistics endpoint. Attackers can craft a malicious direction string containing SQL subqueries that flows unsanitized into a Doctrine QueryBuilder ORDER BY clause, enabling time-based, boolean-oracle, and error-based extraction of sensitive data including long URLs, visitor records, IP addresses, geolocation data, user agents, and hashed API key secrets from any tenant.

Shlink version 2.6.0 contains a server-side request forgery (SSRF) vulnerability that allows authenticated API key holders to make the server perform arbitrary HTTP GET requests. This occurs when a crafted long URL is supplied during short URL creation with title auto-resolution enabled. The vulnerability can be exploited to access internal network resources, including cloud metadata endpoints, by leveraging redirects from public hosts. The vulnerability has a medium severity with a CVSS score of 5.3.

A Server-Side Request Forgery (SSRF) vulnerability exists in the automatic short URL title resolution component of shlink version 5.0.1. This flaw allows attackers to supply a crafted longUrl parameter to scan internal resources. The vulnerability has a high severity score and impacts confidentiality and integrity without requiring authentication or user interaction.