Shlink
Monthly
CSV formula injection in Shlink 5.0.0-5.1.5 enables unauthenticated remote attackers to embed DDE or WEBSERVICE spreadsheet formulas into visit export data by supplying formula-triggering values in User-Agent, Referer, or request path headers targeting any short URL. The payload lies dormant in Shlink's visit log until an administrator exports the data as CSV and opens it in a spreadsheet application (Excel, LibreOffice Calc) with formula evaluation enabled, at which point the formula executes in the context of the administrator's machine. A public proof-of-concept repository exists; no CISA KEV listing is present, and no public exploit exploitation in the wild has been confirmed at time of analysis.
Blind SQL injection in Shlink's tag statistics REST endpoint allows any API key holder to extract sensitive data from the underlying database across all tenants. The unvalidated `direction` value of the `orderBy` query parameter flows unsanitized into a Doctrine QueryBuilder ORDER BY clause, enabling time-based, boolean-oracle, and error-based extraction of long URLs, visitor records, IP addresses, geolocation data, user agents, and hashed API key secrets. A public proof-of-concept exploit is available on GitHub, no public exploit identified at time of analysis as confirmed actively exploited, but the low barrier to exploitation - any valid API key suffices - makes this a genuine remediation priority for Shlink operators.
Server-side request forgery in Shlink allows authenticated API key holders to coerce the server into issuing arbitrary HTTP GET requests to internal network targets, including cloud metadata endpoints such as 169.254.169.254, by submitting crafted URLs during short URL creation when title auto-resolution is enabled. The server follows HTTP redirects from attacker-controlled public hosts to otherwise-inaccessible internal addresses, then returns fetched content via the HTML title element in the API response, enabling exfiltration of internal service data. No active exploitation is confirmed in CISA KEV, but a public proof-of-concept advisory repository exists, and the attack requires only a valid API key with title auto-resolution active.
CSV formula injection in Shlink 5.0.0-5.1.5 enables unauthenticated remote attackers to embed DDE or WEBSERVICE spreadsheet formulas into visit export data by supplying formula-triggering values in User-Agent, Referer, or request path headers targeting any short URL. The payload lies dormant in Shlink's visit log until an administrator exports the data as CSV and opens it in a spreadsheet application (Excel, LibreOffice Calc) with formula evaluation enabled, at which point the formula executes in the context of the administrator's machine. A public proof-of-concept repository exists; no CISA KEV listing is present, and no public exploit exploitation in the wild has been confirmed at time of analysis.
Blind SQL injection in Shlink's tag statistics REST endpoint allows any API key holder to extract sensitive data from the underlying database across all tenants. The unvalidated `direction` value of the `orderBy` query parameter flows unsanitized into a Doctrine QueryBuilder ORDER BY clause, enabling time-based, boolean-oracle, and error-based extraction of long URLs, visitor records, IP addresses, geolocation data, user agents, and hashed API key secrets. A public proof-of-concept exploit is available on GitHub, no public exploit identified at time of analysis as confirmed actively exploited, but the low barrier to exploitation - any valid API key suffices - makes this a genuine remediation priority for Shlink operators.
Server-side request forgery in Shlink allows authenticated API key holders to coerce the server into issuing arbitrary HTTP GET requests to internal network targets, including cloud metadata endpoints such as 169.254.169.254, by submitting crafted URLs during short URL creation when title auto-resolution is enabled. The server follows HTTP redirects from attacker-controlled public hosts to otherwise-inaccessible internal addresses, then returns fetched content via the HTML title element in the API response, enabling exfiltration of internal service data. No active exploitation is confirmed in CISA KEV, but a public proof-of-concept advisory repository exists, and the attack requires only a valid API key with title auto-resolution active.