Vulnerability: Directory traversal vulnerability in delivery-dev/al.php in Revive Adserver before 3.2.2 allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the layerstyle parameter.
Vulnerability ID: CVE-2015-7372
CWE: CWE-22
Severity score: 6.4
Project: https://github.com/revive-adserver/revive-adserver
Published: 2015-10-14
File: www/delivery_dev/al.php
Commit message: Fix CVE-2015-7372

Local File Inclusion
--------------------

Krzysztof K. Wasielewski reported that the layerstyle parameter in al.php was
not properly sanitized, causing a potential LFI vulnerability. Under normal
circumstances, an attacker would need to place a file named layerstyle.inc.php
in an arbitrary directory on the server and craft the layerstyle parameter
accordingly to load it. If an old version of PHP is being used the server,
other attack techniques might be possible, e.g. NULL-byte truncation.

CWE: CWE-98
CVSSv2: 7.6 (AV:N/AC:H/Au:N/C:C/I:C/A:C)
Commit author: Matteo Beccati

Vulnerable version (before fix):
     $layerstyle = 'geocities'; }  // Include layerstyle if (file_exists(MAX_PATH . $conf['pluginPaths']['plugins'] . 'invocationTags/oxInvocationTags/layerstyles/' . $layerstyle . '/layerstyle.inc.php')) {     include MAX_PATH . $conf['pluginPaths']['plugins'] . 'invocationTags/oxInvocationTags/layerstyles/' . $layerstyle . '/layerstyle.inc.php'; } else {     // Don't generate output when plugin layerstyleisn't available,just send javascript comment on fail     echo '// Cannot load required layerstyle file. Check if openXInvocationTags plugin is installed';     exit(1); }  //Register any script specific input variables

Fixed version (after fix):
     $layerstyle = 'geocities'; }  $plugin = MAX_PATH.$conf['pluginPaths']['plugins'].'invocationTags/oxInvocationTags/layerstyles/'.$layerstyle.'/layerstyle.inc.php';  if (!preg_match('/^[a-z0-9-]{1,64}$/Di', $layerstyle) || !@include($plugin)) {     // Don't generate output when plugin layerstyleisn't available,just send javascript comment on fail     MAX_sendStatusCode(404);     echo '// Cannot load required layerstyle file. Check if openXInvocationTags plugin is installed';     exit; }  //Register any script specific input variables

Patch:
patch: @@ -27,13 +27,13 @@
     $layerstyle = 'geocities';
 }
 
-// Include layerstyle
-if (file_exists(MAX_PATH . $conf['pluginPaths']['plugins'] . 'invocationTags/oxInvocationTags/layerstyles/' . $layerstyle . '/layerstyle.inc.php')) {
-    include MAX_PATH . $conf['pluginPaths']['plugins'] . 'invocationTags/oxInvocationTags/layerstyles/' . $layerstyle . '/layerstyle.inc.php';
-} else {
+$plugin = MAX_PATH.$conf['pluginPaths']['plugins'].'invocationTags/oxInvocationTags/layerstyles/'.$layerstyle.'/layerstyle.inc.php';
+
+if (!preg_match('/^[a-z0-9-]{1,64}$/Di', $layerstyle) || !@include($plugin)) {
     // Don't generate output when plugin layerstyleisn't available,just send javascript comment on fail
+    MAX_sendStatusCode(404);
     echo '// Cannot load required layerstyle file. Check if openXInvocationTags plugin is installed';
-    exit(1);
+    exit;
 }
 
 //Register any script specific input variables
path: www/delivery_dev/al.php