How to remediate – Revive Adserver Detection

1. Introduction

Revive Adserver Detection identifies instances of the open source Revive Adserver software running on a web server. This matters because publicly exposed ad servers can be targets for malicious activity, including advertising fraud and redirection to harmful sites. Systems usually affected are those hosting websites that use self-managed advertising solutions. A successful exploit could lead to compromised data confidentiality, integrity, and availability of the ad server itself and potentially connected systems.

2. Technical Explanation

Revive Adserver is an open source web application used for managing online advertisements. The vulnerability lies in having an exposed instance of this software accessible from the internet. Attackers can exploit known vulnerabilities within Revive Adserver to gain unauthorized access or disrupt service. There are no specific CVEs associated with simply running the software, but older versions may have unpatched flaws. An attacker could potentially inject malicious code into ad campaigns or modify server settings.

• Root cause: The web server hosts an open source application with a known attack surface.
• Exploit mechanism: Attackers scan for publicly accessible Revive Adserver instances and attempt to exploit vulnerabilities through the web interface, potentially using default credentials or exploiting code flaws.
• Scope: Web servers running any version of Revive Adserver (formerly OpenX Source) are affected.

3. Detection and Assessment

Confirming a vulnerable system involves identifying whether Revive Adserver is hosted on the web server. A quick check can be performed by examining the application’s banner or source code. A thorough method includes using vulnerability scanners.

• Quick checks: Access the web server in a browser and look for branding elements associated with Revive Adserver, such as logos or specific text within the user interface.
• Scanning: Nessus plugin ID 163958 can detect Revive Adserver installations. OpenVAS also has relevant scans. These are examples only.
• Logs and evidence: Examine web server access logs for requests to directories commonly associated with Revive Adserver, such as /www/admin or /openx/.

curl -I http://target.example.com | grep "Server: Apache"

4. Solution / Remediation Steps

Fixing this issue involves either securing the Revive Adserver installation or removing it from the web server. The following steps provide a guide to both options.

4.1 Preparation

• Ensure you have access to the Revive Adserver configuration files and database credentials. A roll back plan involves restoring from the previous backup.
• A change window may be needed depending on the size of the installation and potential impact. Approval from a system owner is recommended.

4.2 Implementation

1. Step 1: If Revive Adserver is no longer required, remove all associated files and directories from the web server.
2. Step 2: Delete any database tables or schemas created by Revive Adserver.
3. Step 3: If Revive Adserver must remain, restrict access using a firewall or web application firewall (WAF).
4. Step 4: Update Revive Adserver to the latest version if possible.

4.3 Config or Code Example

Before

# Apache configuration allowing access from anywhere
<Directory /var/www/revive-adserver>
    Options Indexes FollowSymLinks
    AllowOverride All
    Require all granted
</Directory>

After

# Apache configuration restricting access to specific IP addresses
<Directory /var/www/revive-adserver>
    Options Indexes FollowSymLinks
    AllowOverride All
    Require ip 192.168.1.0/24  # Replace with allowed IPs
</Directory>

4.4 Security Practices Relevant to This Vulnerability

Several security practices can help prevent this issue and similar exposures. Least privilege reduces the impact of a successful attack, while input validation prevents malicious code injection.

• Practice 1: Implement least privilege access controls to limit who can modify Revive Adserver settings or data.
• Practice 2: Use input validation on all user-supplied data to prevent cross-site scripting (XSS) and other attacks.

4.5 Automation (Optional)

# Example Bash script to block access via firewall (replace with your firewall rules)
#!/bin/bash
sudo ufw deny from any to any port 80 proto tcp comment "Block Revive Adserver Access"
sudo ufw enable

5. Verification / Validation

Confirming the fix involves verifying that external access to Revive Adserver is restricted or that the software has been removed. Re-run the earlier detection methods and perform a simple service smoke test.

• Post-fix check: Attempt to access the Revive Adserver login page from an external network. You should receive a connection refused error or be redirected to an error page.
• Re-test: Re-run the curl command from section 3 and confirm that branding elements are no longer visible, or the scanner reports no detection.
• Smoke test: If Revive Adserver is still running, verify that authorized users can log in and manage ad campaigns.
• Monitoring: Monitor web server logs for any unauthorized access attempts to Revive Adserver directories.

curl -I http://target.example.com | grep "Server" # Should not show Revive Adserver branding

6. Preventive Measures and Monitoring

Updating security baselines and implementing checks in CI/CD pipelines can prevent similar exposures. A sensible patch or config review cycle is also important.

• Baselines: Update your web server security baseline to include a check for unnecessary software installations like Revive Adserver.
• Asset and patch process: Implement a monthly review of installed software and apply patches promptly.

7. Risks, Side Effects, and Roll Back

Removing Revive Adserver may disrupt advertising functionality on the website. Restricting access could impact authorized users. A roll back involves restoring from the previous backup.

• Risk or side effect 1: Removing Revive Adserver will stop all ad serving until a replacement is implemented.
• Risk or side effect 2: Restricting access may require updating firewall rules and could impact legitimate users if not configured correctly.

8. References and Resources

• Vendor advisory or bulletin: https://www.revive-adserver.com/
• NVD or CVE entry: Not applicable for simply running the software; check specific versions for known vulnerabilities.
• Product or platform documentation relevant to the fix: https://docs.revive-adserver.com/