========================================================================
Revive Adserver Security Advisory                     REVIVE-SA-2016-001
========================================================================
http://www.revive-adserver.com/security/revive-sa-2016-001
========================================================================
CVE-IDs:               TBA
Date:                  2016-03-02
Risk Level:            Medium
Applications affected: Revive Adserver
Versions affected:     <= 3.2.2
Versions not affected: >= 3.2.3
Website:               http://www.revive-adserver.com/
========================================================================


========================================================================
Vulnerability 1 - Improper Restriction of Excessive Authentication
                  Attempts
========================================================================
CVE-ID: TBA
CWE-ID: CWE-307
CVSSv2: 8.5 (AV:N/AC:L/Au:N/C:C/I:P/A:N)
========================================================================

Karan M. Tank and Smit B. Shah have reported via HackerOne that the
login page of Revive Adserver was vulnerable to password-guessing
attacks. An account lockdown feature was considered, but rejected to
avoid introducing service disruptions to regular users during such
attacks. A random delay has instead been introduced as a counter-measure
in case of password failures, along with a system to discourage parallel
brute forcing. These systems will effectively allow the valid users to
log in to the adserver, even while an attack is in progress.

A CVE-ID has been requested, but not assigned yet.

References
==========
https://cwe.mitre.org/data/definitions/307.html
https://github.com/revive-adserver/revive-adserver/commit/84794139


========================================================================
Vulnerability 2 - Session Fixation
========================================================================
CVE-ID: TBA
CWE-ID: CWE-384
CVSSv2: 7.8 (AV:N/AC:M/Au:N/C:C/I:P/A:N)
========================================================================

The HackerOne users kaviya and Kamini Singh have independently reported
that Revive Adserver was vulnerable to session fixation, by allowing
arbitrary session identifiers to be forced and, at the same time, by not
invalidating the existing session upon a successful authentication.
Under some circumstances, that could have been an opportunity for an
attacker to steal an authenticated sessions.

A CVE-ID has been requested, but not assigned yet.

References
==========

https://cwe.mitre.org/data/definitions/384.html
https://github.com/revive-adserver/revive-adserver/commit/49103656


========================================================================
Vulnerability 3 - Persistent XSS
========================================================================
CVE-ID: TBA
CWE-ID: CWE-79
CVSSv2: 5.6 (AV:N/AC:H/Au:S/C:C/I:P/A:N)
========================================================================

Tengku Zahasman has reported via HackerOne that usernames were not
properly escaped when displayed in the audit trail widget of the
dashboard upon login, allowing persistent XSS attacks. An authenticated
user with enough privileges to create other users could exploit the
vulnerability to access the administrator account.

A CVE-ID has been requested, but not assigned yet.

References
==========

https://cwe.mitre.org/data/definitions/79.html
https://github.com/revive-adserver/revive-adserver/commit/8d8c6df3


========================================================================
Vulnerability 4 - Cross-Site Request Forgery (CSRF)
========================================================================
CVE-ID: TBA
CWE-ID: CWE-352
CVSSv2: 5 (AV:N/AC:L/Au:N/C:N/I:N/A:P)
========================================================================

An undisclosed user has reported via HackerOne that the password
recovery form in Revive Adserver was vulnerable to CSRF attacks. This
vulnerability could be exploited to send a large number of password
recovery emails to the registered users, especially in conjunction with
a bug that caused recovery emails to be sent to all the users at once.
Both issues have been fixed.

A CVE-ID has been requested, but not assigned yet.

References
==========

https://cwe.mitre.org/data/definitions/352.html
https://github.com/revive-adserver/revive-adserver/commit/3aaebcc7


========================================================================
Vulnerability 5 - Reflected XSS
========================================================================
CVE-ID: TBA
CWE-ID: CWE-79
CVSSv2: 3.5 (AV:N/AC:M/Au:S/C:N/I:P/A:N)
========================================================================

The HackerOne user @decidedlygray has reported that the
affiliate-preview.php script in www/admin is vulnerable to a reflected
XSS attack. This vulnerability could be used by an attacker to steal the
session ID of an authenticated user, by tricking them into visiting a
specifically crafted URL.

A CVE-ID has been requested, but not assigned yet.

References
==========
https://cwe.mitre.org/data/definitions/79.html
https://github.com/revive-adserver/revive-adserver/commit/a323fd62
https://github.com/revive-adserver/revive-adserver/commit/e17a7ec3


========================================================================
Vulnerability 6 - Information Exposure Through Discrepancy
========================================================================
CVE-ID: TBA
CWE-ID: CWE-203
CVSSv2: 5 (AV:N/AC:L/Au:N/C:P/I:N/A:N)
========================================================================

Karan M. Tank and Smit B. Shah have reported via HackerOne that it was
possible to check whether or not an email address was associated to one
or more user accounts on a target Revive Adserver instance by examining
the message printed by the password recovery system. Such information
cannot however be used directly to log in to the system, which requires
a username.

A CVE-ID has been requested, but not assigned yet.

References
==========
https://cwe.mitre.org/data/definitions/203.html
https://github.com/revive-adserver/revive-adserver/commit/38223a84


========================================================================
Vulnerability 7 - Persistent XSS
========================================================================
CVE-ID: TBA
CWE-ID: CWE-79
CVSSv2: 3.5 (AV:N/AC:M/Au:S/C:N/I:P/A:N)
========================================================================

Johan Caluwe has reported via HackerOne two vectors for persistent XSS
attacks via the Revive Adserver user interface, both requiring a trusted
(non-admin) account:

the website name wasn't properly escaped when displayed in the
campaign-zone.php script; and
the banner image URL for external banners wasn't properly escaped when
displayed in most of the banner related pages.

A CVE-ID has been requested, but not assigned yet.

References
==========
https://cwe.mitre.org/data/definitions/79.html
https://github.com/revive-adserver/revive-adserver/commit/f6880330


========================================================================
Vulnerability 8 - Cross-Site Request Forgery (CSRF)
========================================================================
CVE-ID: TBA
CWE-ID: CWE-352
CVSSv2: 5 (AV:N/AC:L/Au:N/C:N/I:N/A:P)
========================================================================

The HackerOne user @decidedlygray has reported a number of scripts in
Revive Adserver's user interface that were vulnerable to CSRF attacks:

 - www/admin/banner-acl.php
 - www/admin/banner-activate.php
 - www/admin/banner-advanced.php
 - www/admin/banner-modify.php
 - www/admin/banner-swf.php
 - www/admin/banner-zone.php
 - www/admin/tracker-modify.php

A CVE-ID has been requested, but not assigned yet.

References
==========
https://cwe.mitre.org/data/definitions/352.html
https://github.com/revive-adserver/revive-adserver/commit/65a9c811


========================================================================
Vulnerability 9 - Cross-Site Request Forgery (CSRF)
========================================================================
CVE-ID: TBA
CWE-ID: CWE-352
CVSSv2: 5 (AV:N/AC:L/Au:N/C:N/I:N/A:P)
========================================================================

Following a number of CSRF reports, the Revive Adserver team have
conducted a security audit of the admin interface scripts in order to
identify and fix other potential CSRF vulnerabilities.

The effort led to fixing 20+ such issues: please see the commit for the
full list of files affected.

A CVE-ID has been requested, but not assigned yet.

References
==========
https://cwe.mitre.org/data/definitions/352.html
https://github.com/revive-adserver/revive-adserver/commit/e563ca61


========================================================================
Vulnerability 10 - Reflected XSS
========================================================================
CVE-ID: TBA
CWE-ID: CWE-79
CVSSv2: 5.6 (AV:N/AC:H/Au:S/C:C/I:P/A:N)
========================================================================

Johan Caluwe has reported via HackerOne that www/admin/stats.php was
vulnerable to reflected XSS attacks via multiple parameters that were
not properly sanitised or escaped when displayed, such as "setPerPage",
"pageId", "bannerid", "pereiod_start", "period_end" and possibly others.

A CVE-ID has been requested, but not assigned yet.

References
==========
https://cwe.mitre.org/data/definitions/79.html
https://github.com/revive-adserver/revive-adserver/commit/ecbe822b48ef4ff61c2c6357c0c94199a81946f4


========================================================================
Solution
========================================================================

We strongly advise people to upgrade to the most recent 3.2.3 release
of Revive Adserver, including those running OpenX Source or older
versions of the application.


========================================================================
Contact Information
========================================================================

The security contact for Revive Adserver can be reached at:
<security AT revive-adserver DOT com>.

Please review http://www.revive-adserver.com/security/ before doing so.


-- 
Matteo Beccati
On behalf of the Revive Adserver Team
http://www.revive-adserver.com/