CVE-2020-8115

MEDIUMNuclei

revive-adserver revive_adserver Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Title source: VulnCheck
STIX 2.1 vulnerability

Record summary

CVE-2020-8115 has a selected CVSS score of 6.1 (medium); EIP currently links 1 Nuclei template.

Description

A reflected XSS vulnerability has been discovered in the publicly accessible afr.php delivery script of Revive Adserver <= 5.0.3 by Jacopo Tediosi. There are currently no known exploits: the session identifier cannot be accessed as it is stored in an http-only cookie as of v3.2.2. On older versions, however, under specific circumstances, it could be possible to steal the session identifier and gain access to the admin interface. The query string sent to the www/delivery/afr.php script was printed back without proper escaping in a JavaScript context, allowing an attacker to execute arbitrary JS code on the browser of the victim.

Description source: CVE List

Exploitation context

Known exploitation

VulnCheck KEV
Listed · Jan 22, 2024 · VulnCheck
Reported exploitation
Observed · VulnCheck

Available material

Nuclei templates
1

Affected products and versions

2
ProductSourceVersion range

https://github.com/revive-adserver/revive-adserver

CVE ListFixed version v5.0.4affected

revive_adserver

Browse revive-adserver / revive_adserver
VulnCheckVersion data not supplied

Nuclei templates

1
ProjectDiscoveryMEDIUMRevive Adserver <=5.0.3 - Cross-Site ScriptingCVSS 6.1

Revive Adserver 5.0.3 and prior contains a reflected cross-site scripting vulnerability in the publicly accessible afr.php delivery script. In older versions, it is possible to steal the session identifier and gain access to the admin interface. The query string sent to the www/delivery/afr.php script is printed back without proper escaping, allowing an attacker to execute arbitrary JavaScript code on the browser of the victim.

Impact

Successful exploitation of this vulnerability could allow an attacker to inject malicious scripts into web pages viewed by users, leading to potential data theft, session hijacking, or defacement.

Remediation

There are currently no known exploits. As of 3.2.2, the session identifier cannot be accessed as it is stored in an http-only cookie.

WeaknessesCWE-79
Authorsmadrobot, dwisiswant0
Template tagscvecve2020xsshackeronerevive-adservervkevvuln
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CPE: cpe:2.3:a:revive-adserver:revive_adserver:*:*:*:*:*:*:*:*
Shodan: http.title:"revive adserver"
Shodan: http.favicon.hash:106844876
FOFA: icon_hash=106844876
FOFA: title="revive adserver"
Google: intitle:"revive adserver"
https://hackerone.com/reports/775693 https://www.revive-adserver.com/security/revive-sa-2020-001/ https://nvd.nist.gov/vuln/detail/CVE-2020-8115 https://github.com/Elsfa7-110/kenzer-templates https://github.com/merlinepedra/nuclei-templates

Source: ProjectDiscovery

References

3