Vulnerability identifier: #VU35942

Vulnerability risk: High

CVSSv3.1: 8.8 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C]

CVE-ID: CVE-2019-5434

CWE-ID: CWE-502

Exploitation vector: Network

Exploit availability: Yes

Vulnerable software:
Revive Adserver
Web applications / Other software

Vendor: OpenX Source

Description

The vulnerability allows a remote non-authenticated attacker to execute arbitrary code.

An attacker could send a specifically crafted payload to the XML-RPC invocation script and trigger the unserialize() call on the "what" parameter in the "openads.spc" RPC method. Such vulnerability could be used to perform various types of attacks, e.g. exploit serialize-related PHP vulnerabilities or PHP object injection. It is possible, although unconfirmed, that the vulnerability has been used by some attackers in order to gain access to some Revive Adserver instances and deliver malware through them to third party websites. This vulnerability was addressed in version 4.2.0.

Mitigation
Install update from vendor's website.

Vulnerable software versions

Revive Adserver: 4.0.0 - 4.1.4

---

External links
http://packetstormsecurity.com/files/155559/Revive-Adserver-4.2-Remote-Code-Execution.html
http://hackerone.com/reports/512076
http://hackerone.com/reports/542670
http://www.revive-adserver.com/security/revive-sa-2019-001/

---

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability. However, proof of concept for this vulnerability is available.