Revive Adserver · Report #3831102
Access control bypass due to request precedence issue in global input registration
Summary
Description
HackerOne community member kushbafti has reported an authorization bypass affecting multiple administration pages in Revive Adserver 6.0.0 through 6.0.8. The regression was introduced in commit 156dee7bc during input-helper simplification. Version 5.5.3 retains the original POST-first behavior and is not affected by this regression. Object identifiers used for permission checks were read with GET precedence, while form submissions could select different objects through POST parameters. A manager could supply identifiers belonging to their own agency in the URL and another agency in the submitted form, allowing unauthorized changes, campaign reassignment and access to other agencies' inventory.
Resolution
Global input registration now gives POST parameters precedence over GET parameters, so permission checks and submitted form values use the same object identifiers.
Security advisory
How it was found
The write-up for this report has not been downloaded yet, or the program disclosed it without one. Read it on HackerOne.