Non-existent redirect that works

[ookris]

Code of Conduct

• I agree to follow this project's Code of Conduct.

Submission validity

• This is not a personal support request, that should be posted on discussions community.
• I checked current issues and this request isn't a duplicate of an existing issue, opened or closed.

Self troubleshooting

• I've read the documentation and made sure to follow it.
• I've read the troubleshooting first steps and frequent issues guides.

Version

1.9.2

Description

A few days ago I received a message that my website was generating traffic to sites "with suspicious content". I was curious about the fact that the link on my website looked strange, was longer than it should be and contained illegal characters:

https://qurl.pl/VDvJZ#cl$.$d=3D23750_smd$.$m=3D20$@$v=3D1237$.$o=3D=

There is no such link in the administration panel, I also searched the MySQL database. I didn't find anything similar there either. And yet, when you click on the link, you are redirected to the target page.

Expectation

Not applicable

Reproduction steps

Not applicable

Context

Not applicable

[dgw]

If the example you provided was one of the suspicious links, it doesn't work any more. Something is modifying the behavior: any keyword containing VDvJZ I tested returns 403 instead of 404 as other random keywords I tested do. If you still see a redirection, it is likely that your browser has cached it. (301 redirects are aggressively cached by most browsers.)

Regardless, it is more than possible for redirection to come from outside YOURLS, via a maliciously modified/hijacked plugin file or server configuration file. If you cannot find this keyword in the database, it must be coming from another source.

[ookris]

Yes, the server returned a 403 error because this link was blocked by the hosting administrator because it was directed to a suspicious website.
If it helps, below is a list of installed and active plugins
404 if not found
Allow Hyphens in Short URLs
BlackListIP
BlackListIP
Check URL
Google Safe Browsing
IQRCodes
Mass Remove Links
Original URL Regex Limiter
Popular Clicks
Random ShortURLs
U-SRV

[dgw]

First you need to know whether the site still actively serves the suspicious redirect, which might require the help of your hosting admin.

If it doesn't, chances are the link was in your database and has been deleted. In this case you should definitely change YOURLS user passwords, and perhaps also the cookiekey value to invalidate existing sessions.

If it does still serve the suspicious redirect, try grep -Ri vdvjz in your YOURLS root and see what comes up.

The plugin list is not likely to help unless you can identify a plugin file containing that string, in which case the source can be checked to determine if the plugin in question was modified after you installed it.

[ookris]

Well, you're right. It turned out that the VDvJZ string is already in the database and is already assigned to another page.
I just wonder why adding the rest of the parameters to the shortened link causes redirection to a completely different page.
Write an e-mail to the hosting administrator to unblock this address and then I will check what appears in the logs

[dgw]

I did a quick audit of the plugins you linked (well, the ones that didn't just point to the homepage of yourls.org) and didn't find very much JavaScript. Normally, the server would only see https://qurl.pl/VDvJZ as the REQUEST_URL and JS on the browser side would be the only way to read the suspicious URI fragment (the part after #).

Depending on where VDvJZ points, the exploit could be on the target site as well. If a 3xx status code redirection does not carry a fragment of its own, many browsers/clients follow HTTP semantics that inherit the fragment of the original link. You can test this yourself with e.g. https://yourls.org/ozh#test, which passes the #test fragment through to https://ozh.org/#test in reasonably current versions of Firefox and Chrome.

This is quite odd indeed. Please keep us posted 😸 though if my theory is correct, I would only need the long URL corresponding to VDvJZ in order to verify whether I'm right that the actual suspicious redirection happens on that end.

[ookris]

The long URL leads to http://lmoperative.com, which unfortunately does not have the correct certificate. Maybe the website itself, which looks rather OK, is actually the problem here. especially since the statistics showed more than a few clicks in a short time.

[dgw]

There's your suspicious JavaScript right at the top of the HTML on lmoperative.com, before even the <html> root element:

<script>if(window.location.hash.length > 0) window.location.href = window.location.origin + '/' + window.location.hash.replace("#","");</script>

It takes the fragment and navigates to lmoperative.com/<hash>, which can lead to further redirects. This is definitively out of the control of YOURLS, as it's using a fragment, which the server never sees.

Question is why that domain ended up in your instance. It is trying to look innocent, but most of the content has no function (plenty of buttons/links pointing to #).

[dgw]

Update: I submitted a domain abuse report to Namecheap, the registrar for lmoperative.com, linking back to this thread where we investigated it.