Softpedia: XSS and LFI Vulnerabilities Fixed in OpenX Advertising Platform

Experts from the High-Tech Bridge Security Research Lab have identified multiple vulnerabilities in OpenX, the popular advertising platform. The flaws can be exploited to execute arbitrary PHP code, launch cross-site scripting (XSS) attacks and compromise affected systems.

The first vulnerability is a Local File Inclusion (LFI) issue that can be exploited by an attacker that has administrative privileges, or by tricking a logged-in OpenX administrator to open a malicious web page that triggers a Cross-Site Request Forgery (CSRF) exploit code.

Experts have also discovered a couple of XSS vulnerabilities that can be leveraged by a remote attacker to get administrators to execute arbitrary code by tricking them into opening a specially crafter link.

The vulnerabilities, which affect Open X 2.8.10 and probably older versions, were reported to the vendor on May 8. They were addressed last week.

Additional technical details and patches are available here.

Source: Softpedia, Eduard Kovacs

SecurityWeek: OpenX Addresses New Security Flaws with Latest Update

Article by Steve Ragan:
OpenX, the open source ad serving platform, patched two flaws last week, after they were discovered by Geneva, Switzerland’s High-Tech Bridge. The platform has had several issues before, and is a favorite target of criminals operating using malvertising as an attack vector.

According to the High-Tech Bridge advisory, OpenX patched two flaws in the final days of June. The first was a file inclusion vulnerability, which if the attacker has administrative privileges, can be used to access stored files such as the webservers /etc/passwd file.

"Successful exploitation of these vulnerabilities requires administrative privileges, however they can also be exploited by a remote non-authenticated attacker via CSRF vector, since the application is prone to Cross-Site Request Forgery (CSRF) attacks. In order to do so an attacker should trick logged-in OpenX administrator to open a specially crafted web page with CSRF exploit code," the advisory explains.

Read Full Article at: SecurityWeek.com

Related posts:
HTB23155: OpenX PHP file inclusion & cross-site scripting
Serious vulnerabilities in OpenX ad platform expose millions to risk

Help Net Security: Serious vulnerabilities in OpenX ad platform expose millions to risk

High-Tech Bridge Security Research Lab discovered multiple vulnerabilities in OpenX, which can be exploited to execute arbitrary PHP code, perform Cross-Site Scripting (XSS) attacks and compromise vulnerable system.

Read More at Help Net Security.

HTB23155: OpenX PHP file inclusion & cross-site scripting

Multiple vulnerabilities (PHP file inclusion and cross-site scripting) in OpenX version 2.8.10 have been discovered by High-Tech Bridge Security Research Lab about 2 months ago and disclosed this week.

• Local File Inclusion in OpenX:
  Input passed via "group" HTTP GET parameter to "/www/admin/plugin-preferences.php" and "/www/admin/plugin-settings.php" scripts is not properly verified before being used in PHP 'include()' function and can be exploited to include arbitrary local files via directory traversal sequences and URL-encoded NULL byte techniques.

• Cross-Site Scripting (XSS) in OpenX:
  The vulnerabilities exists due to insufficient filtration of user-supplied data in "package" HTTP GET parameter passed to "/www/admin/plugin-index.php" and "group" HTTP GET parameter passed to "/www/admin/plugin-settings.php" scripts.

To fix this issues replace files from SVN repository as mentioned in High-Tech Bridge security advisory HTB23155: Multiple Vulnerabilities in OpenX, also diff-dile is available. Proof-of-Concept (PoC) examples also available on researcher's page.

OpenX vulnerabilities in SemperVideo's News

Security Advisory in OpenX HTB23116 mentioned in SemperVideo's YouTube channel (News 07.04.2013, about OpenX from 2:33):

Story about OpenX

OpenX Developers fixed vulnerabilities in OpenX 2.8.10 (September 28, 2012), which suffer from cross-site scripting and SQL injection vulnerabilities. After 4 months Golem.de at January 19, 2013 has published information about the further adventures of this vulnerabilities: BSI warnt vor Werbebannern mit Javascript-Malware.

Related Links:

• High-Tech Bridge Advisory HTB23116 - Multiple vulnerabilities in OpenX
• Schädliche Werbebanner in großem Umfang zur Verbreitung von Schadprogrammen mittels Drive-by-Exploits genutzt

Always stay secure.

HTB23116: OpenX cross-site scripting & SQL injection vulnerabilities

Multiple vulnerabilities in OpenX have been discovered by High-Tech Bridge Security Research Lab 3 week ago and disclosed this week.

• Cross-Site Scripting (XSS) in OpenX: Input passed via the "parent" GET parameter to "www/admin/plugin-index.php" is not properly sanitised before being returned to the user.

• SQL Injection in OpenX: Input passed via the "ids[]" POST parameter to "www/admin/campaign-zone-link.php" is not properly sanitised before being used in SQL query.

To fix this issues replace files from SVN repository as mentioned in High-Tech Bridge security advisory HTB23116: Multiple vulnerabilities in OpenX. PoC examples also available on researcher's page.