Revive Adserver 4.0.0 XSS / Deserialization / Session Fixation
Posted on 30 November -0001
<HTML><HEAD><TITLE>Revive Adserver 4.0.0 XSS / Deserialization / Session Fixation</TITLE><META http-equiv="Content-Type" content="text/html; charset=utf-8"></HEAD><BODY>======================================================================== Revive Adserver Security Advisory REVIVE-SA-2017-001 ======================================================================== http://www.revive-adserver.com/security/revive-sa-2017-001 ======================================================================== CVE-IDs: TBA Date: 2017-01-31 Risk Level: High Applications affected: Revive Adserver Versions affected: <= 4.0.0 Versions not affected: >= 4.0.1 Website: http://www.revive-adserver.com/ ======================================================================== ======================================================================== Vulnerability 1 - Deserialization of Untrusted Data ======================================================================== CVE-ID: TBA CWE-ID: CWE-502 CVSSv3 Vector CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C CVSSv3 Base Score: 9.8 CVSSv3 Temporal Score: 8.5 ======================================================================== HackerOne user Nicolas GrA(c)goire - Agarri has reported that Revive Adserver was unserializing untrusted data submitted via cookies in the delivery scripts. An attacker could use such vector to either perform generic RCE attacks (e.g. when a vulnerable PHP version is being used) or, potentially, application-specific attacks. References ========== https://cwe.mitre.org/data/definitions/502.html https://github.com/revive-adserver/revive-adserver/commit/05bb9f4d https://github.com/revive-adserver/revive-adserver/commit/a51ee668 ======================================================================== Vulnerability 2 - Session Fixation ======================================================================== CVE-ID: TBA CWE-ID: CWE-384 CVSSv3 Vector CVSS:3.0/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:N/E:U/RL:O/RC:C CVSSv3 Base Score: 5.9 CVSSv3 Temporal Score: 5.2 ======================================================================== HackerOne user pavanw3b has reported that Revive Adserver wasn't properly invalidating the current session when setting a new password via the forgot password mechanism. This could allow attackers having access to the session ID to keep the authenticated session alive. References ========== https://cwe.mitre.org/data/definitions/384.html https://github.com/revive-adserver/revive-adserver/commit/b088012e ======================================================================== Vulnerability 3 - Persistent XSS ======================================================================== CVE-ID: TBA CWE-ID: CWE-79 CVSSv3 Vector CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N/E:U/RL:O/RC:C CVSSv3 Base Score: 4.2 CVSSv3 Temporal Score: 3.7 ======================================================================== HackerOne user pavanw3b has reported that Revive Adserver was vulnerable to a persistent XSS attack: an authenticated user could set their own email address to a specifically crafted string which was then displayed without proper escaping in the context of other users (e.g. the administrator user), giving them an opportunity to steal a session with elevated privileges. References ========== https://cwe.mitre.org/data/definitions/75.html https://github.com/revive-adserver/revive-adserver/commit/0b311d3f ======================================================================== Vulnerability 4 - Reflected XSS ======================================================================== CVE-ID: TBA CWE-ID: CWE-79 CVSSv3 Vector CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N/E:U/RL:O/RC:C CVSSv3 Base Score: 4.2 CVSSv3 Temporal Score: 3.7 ======================================================================== HackerOne user pavanw3b has reported that Revive Adserver was vulnerable to a reflected XSS attack: several of the parameters used in the invocation code generation for interstitial zones weren't properly escaped when displayed. References ========== https://cwe.mitre.org/data/definitions/79.html https://github.com/revive-adserver/revive-adserver/commit/f2f64d94 ======================================================================== Solution ======================================================================== We strongly advise people to upgrade to the most recent 4.0.1 release of Revive Adserver, including those running OpenX Source or older versions of the application. ======================================================================== Contact Information ======================================================================== The security contact for Revive Adserver can be reached at: <security AT revive-adserver DOT com>. Please review http://www.revive-adserver.com/security/ before doing so. -- Matteo Beccati On behalf of the Revive Adserver Team http://www.revive-adserver.com/ </BODY></HTML>
