exploit the possibilities

Revive Adserver 4.0.0 XSS / Deserialization / Session Fixation

Revive Adserver 4.0.0 XSS / Deserialization / Session Fixation
Posted Jan 31, 2017
Authored by Matteo Beccati

Revive Adserver versions 4.0.0 and below suffer from cross site scripting, session fixation, and deserialization of untrusted data vulnerabilities.

tags | advisory, vulnerability, xss
MD5 | 7851849891b07f255ee87bf675b8f570

Revive Adserver 4.0.0 XSS / Deserialization / Session Fixation

Change Mirror Download
========================================================================
Revive Adserver Security Advisory REVIVE-SA-2017-001
========================================================================
http://www.revive-adserver.com/security/revive-sa-2017-001
========================================================================
CVE-IDs: TBA
Date: 2017-01-31
Risk Level: High
Applications affected: Revive Adserver
Versions affected: <= 4.0.0
Versions not affected: >= 4.0.1
Website: http://www.revive-adserver.com/
========================================================================


========================================================================
Vulnerability 1 - Deserialization of Untrusted Data
========================================================================
CVE-ID: TBA
CWE-ID: CWE-502

CVSSv3 Vector CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
CVSSv3 Base Score: 9.8
CVSSv3 Temporal Score: 8.5
========================================================================

HackerOne user Nicolas GrA(c)goire - Agarri has reported that Revive
Adserver was unserializing untrusted data submitted via cookies in the
delivery scripts. An attacker could use such vector to either perform
generic RCE attacks (e.g. when a vulnerable PHP version is being used)
or, potentially, application-specific attacks.


References
==========
https://cwe.mitre.org/data/definitions/502.html
https://github.com/revive-adserver/revive-adserver/commit/05bb9f4d
https://github.com/revive-adserver/revive-adserver/commit/a51ee668


========================================================================
Vulnerability 2 - Session Fixation
========================================================================
CVE-ID: TBA
CWE-ID: CWE-384

CVSSv3 Vector CVSS:3.0/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:N/E:U/RL:O/RC:C
CVSSv3 Base Score: 5.9
CVSSv3 Temporal Score: 5.2
========================================================================

HackerOne user pavanw3b has reported that Revive Adserver wasn't
properly invalidating the current session when setting a new password
via the forgot password mechanism. This could allow attackers having
access to the session ID to keep the authenticated session alive.

References
==========

https://cwe.mitre.org/data/definitions/384.html
https://github.com/revive-adserver/revive-adserver/commit/b088012e


========================================================================
Vulnerability 3 - Persistent XSS
========================================================================
CVE-ID: TBA
CWE-ID: CWE-79

CVSSv3 Vector CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N/E:U/RL:O/RC:C
CVSSv3 Base Score: 4.2
CVSSv3 Temporal Score: 3.7
========================================================================

HackerOne user pavanw3b has reported that Revive Adserver was vulnerable
to a persistent XSS attack: an authenticated user could set their own
email address to a specifically crafted string which was then displayed
without proper escaping in the context of other users (e.g. the
administrator user), giving them an opportunity to steal a session with
elevated privileges.

References
==========

https://cwe.mitre.org/data/definitions/75.html
https://github.com/revive-adserver/revive-adserver/commit/0b311d3f


========================================================================
Vulnerability 4 - Reflected XSS
========================================================================
CVE-ID: TBA
CWE-ID: CWE-79

CVSSv3 Vector CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N/E:U/RL:O/RC:C
CVSSv3 Base Score: 4.2
CVSSv3 Temporal Score: 3.7
========================================================================

HackerOne user pavanw3b has reported that Revive Adserver was vulnerable
to a reflected XSS attack: several of the parameters used in the
invocation code generation for interstitial zones weren't properly
escaped when displayed.

References
==========

https://cwe.mitre.org/data/definitions/79.html
https://github.com/revive-adserver/revive-adserver/commit/f2f64d94


========================================================================
Solution
========================================================================

We strongly advise people to upgrade to the most recent 4.0.1
release of Revive Adserver, including those running OpenX Source or
older versions of the application.


========================================================================
Contact Information
========================================================================

The security contact for Revive Adserver can be reached at:
<security AT revive-adserver DOT com>.

Please review http://www.revive-adserver.com/security/ before doing so.


--
Matteo Beccati
On behalf of the Revive Adserver Team
http://www.revive-adserver.com/

Comments

RSS Feed Subscribe to this comment feed

No comments yet, be the first!

Login or Register to post a comment

File Archive:

July 2019

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Jul 1st
    34 Files
  • 2
    Jul 2nd
    15 Files
  • 3
    Jul 3rd
    9 Files
  • 4
    Jul 4th
    8 Files
  • 5
    Jul 5th
    2 Files
  • 6
    Jul 6th
    3 Files
  • 7
    Jul 7th
    1 Files
  • 8
    Jul 8th
    15 Files
  • 9
    Jul 9th
    15 Files
  • 10
    Jul 10th
    20 Files
  • 11
    Jul 11th
    17 Files
  • 12
    Jul 12th
    16 Files
  • 13
    Jul 13th
    2 Files
  • 14
    Jul 14th
    1 Files
  • 15
    Jul 15th
    20 Files
  • 16
    Jul 16th
    27 Files
  • 17
    Jul 17th
    7 Files
  • 18
    Jul 18th
    5 Files
  • 19
    Jul 19th
    12 Files
  • 20
    Jul 20th
    0 Files
  • 21
    Jul 21st
    0 Files
  • 22
    Jul 22nd
    0 Files
  • 23
    Jul 23rd
    0 Files
  • 24
    Jul 24th
    0 Files
  • 25
    Jul 25th
    0 Files
  • 26
    Jul 26th
    0 Files
  • 27
    Jul 27th
    0 Files
  • 28
    Jul 28th
    0 Files
  • 29
    Jul 29th
    0 Files
  • 30
    Jul 30th
    0 Files
  • 31
    Jul 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2019 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close