#VU35942 Deserialization of Untrusted Data in Revive Adserver - CVE-2019-5434
Published: May 6, 2019 / Updated: June 17, 2021
Vulnerability identifier: #VU35942
Vulnerability risk: High
CVSSv4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/U:Amber
CVE-ID: CVE-2019-5434
CWE-ID: CWE-502
Exploitation vector: Remote access
Exploit availability:
Public exploit is available
Vulnerable software:
Revive Adserver
Revive Adserver
Software vendor:
OpenX Source
OpenX Source
Description
The vulnerability allows a remote non-authenticated attacker to execute arbitrary code.
An attacker could send a specifically crafted payload to the XML-RPC invocation script and trigger the unserialize() call on the "what" parameter in the "openads.spc" RPC method. Such vulnerability could be used to perform various types of attacks, e.g. exploit serialize-related PHP vulnerabilities or PHP object injection. It is possible, although unconfirmed, that the vulnerability has been used by some attackers in order to gain access to some Revive Adserver instances and deliver malware through them to third party websites. This vulnerability was addressed in version 4.2.0.
Remediation
Install update from vendor's website.