diff --git a/cves/2021/CVE-2021-22873.yaml b/cves/2021/CVE-2021-22873.yaml new file mode 100644 index 0000000000..66e7735651 --- /dev/null +++ b/cves/2021/CVE-2021-22873.yaml @@ -0,0 +1,29 @@ +id: CVE-2021-22873 + +info: + name: Revive Adserver < 5.1.0 Open Redirect + author: pudsec + severity: low + description: Revive Adserver before 5.1.0 is vulnerable to open redirects via the dest, oadest, and ct0 parameters of the lg.php and ck.php delivery scripts. + reference: https://nvd.nist.gov/vuln/detail/CVE-2021-22873 + +requests: + - method: GET + path: + - "{{BaseURL}}/ads/www/delivery/lg.php?dest=http://example.com" + - "{{BaseURL}}/adserve/www/delivery/lg.php?dest=http://example.com" + - "{{BaseURL}}/adserver/www/delivery/lg.php?dest=http://example.com" + - "{{BaseURL}}/openx/www/delivery/lg.php?dest=http://example.com" + - "{{BaseURL}}/revive/www/delivery/lg.php?dest=http://example.com" + - "{{BaseURL}}/www/delivery/lg.php?dest=http://example.com" + + redirects: true + matchers-condition: and + matchers: + - type: status + status: + - 200 + - type: word + words: + - "Example Domain" + part: body