Revive Adserver · Report #4075098
Unauthenticated reflected XSS in update history
Summary
Description
HackerOne community member Matías López Pereira (HackerOne: @mlopez01) reported a reflected XSS vulnerability in updates-history.php. Attacker-controlled values were included in XML command attributes without appropriate encoding, allowing crafted input to inject executable XHTML into the response.
The preliminary session check covered xajax POST requests but omitted GET requests, exposing an unauthenticated attack path. Authenticated administrator requests could also reach the unsafe XML output.
Resolution
The preliminary session check now applies to both GET and POST xajax requests. XML command attribute values are also encoded in both response serializers, preventing crafted values from injecting markup.
Security advisory
How it was found
The write-up for this report has not been downloaded yet, or the program disclosed it without one. Read it on HackerOne.