Revive Adserver · Report #3958112
Missing campaign ownership check in zone bulk linking
Summary
Description
HackerOne community member miauzxw reported a missing campaign ownership check in the bulk-linking operation of zone-include.php. The single-link operation and XML-RPC API also lacked the corresponding check. A manager, or a trafficker with zone-linking permissions, could associate another agency's campaign with their own zone.
Although agency filtering prevented foreign banners from being linked, the unauthorized association could expose the foreign campaign's name, type and identifier in the linked-campaign listing.
Resolution
Campaign ownership is now checked in the bulk-linking and single-link operations and in the XML-RPC campaign-linking method.
Security advisory
How it was found
The write-up for this report has not been downloaded yet, or the program disclosed it without one. Read it on HackerOne.