Revive Adserver <5.1.0 - Open Redirect

mediumseverity

6.1CVSS score

69.6%likelihood of exploitation, next 30 days

99%of all CVEs are less likely

Readycheck to confirm it

Revive Adserver before 5.1.0 contains an open redirect vulnerability via the dest, oadest, and ct0 parameters of the lg.php and ck.php delivery scripts. An attacker can redirect a user to a malicious site and possibly obtain sensitive information, modify data, and/or execute unauthorized operations.

Impact

Successful exploitation of this vulnerability could allow an attacker to redirect users to malicious websites, leading to phishing attacks or the execution of further attacks.

Fix

Upgrade Revive Adserver to version 5.1.0 or later to mitigate this vulnerability.

How to confirm it

Send: GET {{BaseURL}}/ads/www/delivery/lg.php?dest=http://interact.sh ; GET {{BaseURL}}/adserve/www/delivery/lg.php?dest=http://interact.sh ; GET {{BaseURL}}/adserver/www/delivery/lg.php?dest=http://interact.sh ; GET {{BaseURL}}/openx/www/delivery/lg.php?dest=http://interact.sh ; GET {{BaseURL}}/revive/www/delivery/lg.php?dest=http://interact.sh
Positive when: matches in header /(?m)^(?:Location\s*?:\s*?)(?:https?:\/\/|\/\/|\/\\\\|\/\\)(?:[a-zA-Z0-9\-_\.@]*…/

Run it with nuclei: nuclei -id CVE-2021-22873 -u <target>

The full check

id: CVE-2021-22873

info:
  name: Revive Adserver <5.1.0 - Open Redirect
  author: pudsec
  severity: medium
  description: Revive Adserver before 5.1.0 contains an open redirect vulnerability via the dest, oadest, and ct0 parameters of the lg.php and ck.php delivery scripts. An attacker can redirect a user to a malicious site and possibly obtain sensitive information, modify data, and/or execute unauthorized operations.
  impact: |
    Successful exploitation of this vulnerability could allow an attacker to redirect users to malicious websites, leading to phishing attacks or the execution of further attacks.
  remediation: |
    Upgrade Revive Adserver to version 5.1.0 or later to mitigate this vulnerability.
  reference:
    - https://hackerone.com/reports/1081406
    - https://github.com/revive-adserver/revive-adserver/issues/1068
    - http://seclists.org/fulldisclosure/2021/Jan/60
    - https://nvd.nist.gov/vuln/detail/CVE-2021-22873
    - http://packetstormsecurity.com/files/161070/Revive-Adserver-5.0.5-Cross-Site-Scripting-Open-Redirect.html
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
    cvss-score: 6.1
    cve-id: CVE-2021-22873
    cwe-id: CWE-601
    epss-score: 0.69561
    epss-percentile: 0.9937
    cpe: cpe:2.3:a:revive-adserver:revive_adserver:*:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 6
    vendor: revive-adserver
    product: revive_adserver
    shodan-query:
      - http.favicon.hash:106844876
      - http.title:"revive adserver"
    fofa-query:
      - icon_hash=106844876
      - title="revive adserver"
    google-query: intitle:"revive adserver"
  tags: cve2021,cve,hackerone,seclists,packetstorm,redirect,revive,revive-adserver,vkev,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/ads/www/delivery/lg.php?dest=http://interact.sh"
      - "{{BaseURL}}/adserve/www/delivery/lg.php?dest=http://interact.sh"
      - "{{BaseURL}}/adserver/www/delivery/lg.php?dest=http://interact.sh"
      - "{{BaseURL}}/openx/www/delivery/lg.php?dest=http://interact.sh"
      - "{{BaseURL}}/revive/www/delivery/lg.php?dest=http://interact.sh"
      - "{{BaseURL}}/www/delivery/lg.php?dest=http://interact.sh"

    stop-at-first-match: true
    host-redirects: true
    max-redirects: 2
    matchers:
      - type: regex
        part: header
        regex:
          - '(?m)^(?:Location\s*?:\s*?)(?:https?:\/\/|\/\/|\/\\\\|\/\\)(?:[a-zA-Z0-9\-_\.@]*)interact\.sh\/?(\/|[^.].*)?$' # https://regex101.com/r/L403F0/1

References

Use this check only on systems you are authorised to test. Where the data comes from