CVE-2016-9455 (published 2017-03-28T02:59Z)

Revive Adserver before 3.2.3 suffers from Cross-Site Request Forgery (CSRF). A number of scripts in Revive Adserver's user interface are vulnerable to CSRF attacks: `www/admin/banner-acl.php`, `www/admin/banner-activate.php`, `www/admin/banner-advanced.php`, `www/admin/banner-modify.php`, `www/admin/banner-swf.php`, `www/admin/banner-zone.php`, `www/admin/tracker-modify.php`.

Severity: MEDIUM
CVSS v2 base score: 6.8 (AV:N/AC:M/Au:N/C:P/I:P/A:P)
CVSS v3 base score: 8.8, HIGH (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-352
cwe_name: Cross-Site Request Forgery (CSRF)
description: The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.
extended_description: When a web server is designed to receive a request from a client without any mechanism for verifying that it was intentionally sent, then it might be possible for an attacker to trick a client into making an unintentional request to the web server which will be treated as an authentic request. This can be done via a URL, image load, XMLHttpRequest, etc. and can result in exposure of data or unintended code execution.
         

Fix information:
repo_url: https://github.com/revive-adserver/revive-adserver
commit_details: repo_url: https://github.com/revive-adserver/revive-adserver
author: Matteo Beccati
author_date: 2015-11-20 08:06:52+01:00
msg: Fix h1 report 97123

Cross-Site Request Forgery (CSRF)
---------------------------------

The HackerOne user @decidedlygray has reported a number of scripts in Revive
Adserver's user interface that were vulnerable to CSRF attacks:

- www/admin/banner-acl.php
- www/admin/banner-activate.php
- www/admin/banner-advanced.php
- www/admin/banner-modify.php
- www/admin/banner-swf.php
- www/admin/banner-zone.php
- www/admin/tracker-modify.php

A CVE-ID has been requested, but not assigned yet.

CWE: CWE-352
CVSSv2: 5 (AV:N/AC:L/Au:N/C:N/I:N/A:P)
repository: repo_url: https://github.com/revive-adserver/revive-adserver
repo_name: revive-adserver/revive-adserver
description: The world's most popular free, open source ad serving system. You can download the latest release at:
repo_language: PHP
owner: revive-adserver
file_changes: filename: banner-acl.php
change_type: ModificationType.MODIFY
diff: @@ -48,6 +48,8 @@ $aEntities = array('clientid' => $clientid, 'campaignid' => $campaignid, 'banner
 if (!empty($action)) {
     $acl = MAX_AclAdjust($acl, $action);
 } elseif (!empty($submit)) {
+    OA_Permission::checkSessionToken();
+
     $acl = (isset($acl)) ? $acl : array();
 
     // Only save when inputs are valid

programming_language: PHP
filename: banner-activate.php
change_type: ModificationType.MODIFY
diff: @@ -36,6 +36,8 @@ OA_Permission::enforceAccessToObject('clients',   $clientid);
 OA_Permission::enforceAccessToObject('campaigns', $campaignid);
 OA_Permission::enforceAccessToObject('banners',   $bannerid, true);
 
+OA_Permission::checkSessionToken();
+
 if (OA_Permission::isAccount(OA_ACCOUNT_ADVERTISER)) {
     if ($value == OA_ENTITY_STATUS_RUNNING) {
         OA_Permission::enforceAllowed(OA_PERM_BANNER_ACTIVATE);

programming_language: PHP
filename: banner-advanced.php
change_type: ModificationType.MODIFY
diff: @@ -39,23 +39,26 @@ phpAds_SessionDataStore();
 /*-------------------------------------------------------*/
 
 if (isset($submitbutton)) {
-    if (isset($bannerid) && $bannerid != '') {
-        // Update banner
-        $doBanners = OA_Dal::factoryDO('banners');
-        $doBanners->get($bannerid);
-        $doBanners->prepend = $prepend;
-        $doBanners->append  = $append;
-        $doBanners->update();
-
-        // Queue confirmation message
-        $translation = new OX_Translation();
-        $translated_message = $translation->translate($GLOBALS['strBannerAdvancedHasBeenUpdated'], array(
-            MAX::constructURL(MAX_URL_ADMIN, 'banner-edit.php?clientid=' .  $clientid . '&campaignid=' . $campaignid . '&bannerid=' . $bannerid),
-            htmlspecialchars($doBanners->description)
-        ));
-        OA_Admin_UI::queueMessage($translated_message, 'local', 'confirm', 0);
-    }
+    OA_Permission::checkSessionToken();
+
+    // Update banner
+    $doBanners = OA_Dal::factoryDO('banners');
+    $doBanners->get($bannerid);
+    $doBanners->prepend = $prepend;
+    $doBanners->append  = $append;
+    $doBanners->update();
+
+    // Queue confirmation message
+    $translation = new OX_Translation();
+    $translated_message = $translation->translate($GLOBALS['strBannerAdvancedHasBeenUpdated'], array(
+        MAX::constructURL(MAX_URL_ADMIN, 'banner-edit.php?clientid=' .  $clientid . '&campaignid=' . $campaignid . '&bannerid=' . $bannerid),
+        htmlspecialchars($doBanners->description)
+    ));
+
+    OA_Admin_UI::queueMessage($translated_message, 'local', 'confirm', 0);
+
     header ("Location: banner-advanced.php?clientid=".$clientid."&campaignid=".$campaignid."&bannerid=".$bannerid);
+    exit;
 }
 
 /*-------------------------------------------------------*/

programming_language: PHP
filename: banner-modify.php
change_type: ModificationType.MODIFY
diff: @@ -31,6 +31,7 @@ phpAds_registerGlobal('bannerid', 'campaignid', 'clientid', 'returnurl', 'duplic
 // Security check
 OA_Permission::enforceAccount(OA_ACCOUNT_MANAGER);
 
+OA_Permission::checkSessionToken();
 
 /*-------------------------------------------------------*/
 /* Main code                                             */

programming_language: PHP
filename: banner-swf.php
change_type: ModificationType.MODIFY
diff: @@ -35,6 +35,8 @@ OA_Permission::enforceAccessToObject('clients',   $clientid);
 OA_Permission::enforceAccessToObject('campaigns', $campaignid);
 OA_Permission::enforceAccessToObject('banners',   $bannerid);
 
+    OA_Permission::checkSessionToken();
+
 if (OA_Permission::isAccount(OA_ACCOUNT_ADVERTISER)) {
     OA_Permission::enforceAllowed(OA_PERM_BANNER_EDIT);
 }

programming_language: PHP
filename: banner-zone.php
change_type: ModificationType.MODIFY
diff: @@ -31,6 +31,8 @@ OA_Permission::enforceAccessToObject('clients',   $clientid);
 OA_Permission::enforceAccessToObject('campaigns', $campaignid);
 OA_Permission::enforceAccessToObject('banners',   $bannerid);
 
+OA_Permission::checkSessionToken();
+
 /*-------------------------------------------------------*/
 /* Store preferences									 */
 /*-------------------------------------------------------*/

programming_language: PHP
filename: tracker-modify.php
change_type: ModificationType.MODIFY
diff: @@ -38,6 +38,8 @@ OA_Permission::enforceAccessToObject('trackers', $trackerid);
 
 if (!empty($trackerid))
 {
+    OA_Permission::checkSessionToken();
+    
     if (!empty($moveto))
     {
         // Delete any campaign-tracker links

programming_language: PHP