CVE-2025-27208 Overview
CVE-2025-27208 is a reflected Cross-Site Scripting (XSS) vulnerability in Revive Adserver version 5.5.2. The flaw resides in the admin-search.php file and is triggered through the compact parameter. An attacker can craft a malicious URL that, when clicked by an authenticated user, executes arbitrary JavaScript in the victim's browser under the Revive Adserver origin. The session cookie is protected from direct access, but attackers can still perform other actions in the context of the authenticated session. The issue is classified under CWE-79 (Improper Neutralization of Input During Web Page Generation).
Critical Impact
Attackers can execute JavaScript in an authenticated administrator's browser session, enabling unauthorized actions against the ad server interface.
Affected Products
- Revive Adserver 5.5.2
- Revive Adserver 6.0.0 rc1
- Revive Adserver instances exposing the administrative interface
Discovery Timeline
- 2025-10-31 - CVE-2025-27208 published to the National Vulnerability Database
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-27208
Vulnerability Analysis
The vulnerability affects the administrative search functionality of Revive Adserver, an open-source ad management platform. The admin-search.php script fails to sanitize the compact query parameter before reflecting it in the rendered HTML response. As a result, attacker-supplied JavaScript delivered through the URL executes when a logged-in user visits the crafted link. Because the payload runs in the browser context of an authenticated administrator, it can trigger administrative operations, manipulate campaigns, or exfiltrate non-HttpOnly data. The session cookie is protected against direct JavaScript access, limiting cookie theft but not preventing on-behalf-of actions through the existing session.
Root Cause
The root cause is improper output encoding of the compact request parameter in admin-search.php. User-controlled input is written into the HTML response without contextual escaping, allowing HTML and script content to break out of the intended data context. This is a classic reflected XSS pattern tracked as CWE-79.
Attack Vector
Exploitation requires user interaction. An attacker must convince an authenticated Revive Adserver user, typically an administrator or advertiser, to click a URL containing a malicious compact parameter value. Delivery methods include phishing emails, malicious advertisements, or links posted on trusted forums. Once clicked, the injected script runs with the privileges of the victim's active session, enabling actions such as modifying ad campaigns, retrieving displayed data, or issuing authenticated requests to other admin endpoints. Details are documented in the HackerOne Vulnerability Report and the Full Disclosure Security Posting.
Detection Methods for CVE-2025-27208
Indicators of Compromise
- HTTP GET requests to admin-search.php containing script tags, event handlers, or encoded JavaScript in the compact parameter
- Referer headers pointing to external or untrusted domains preceding requests to /admin-search.php
- Unusual administrative actions performed shortly after a user clicks an external link to the Revive Adserver interface
Detection Strategies
- Inspect web server access logs for compact= values containing <script, javascript:, onerror=, or URL-encoded equivalents such as %3Cscript
- Deploy Web Application Firewall (WAF) rules to flag reflected XSS payloads targeting the admin-search.php endpoint
- Correlate outbound requests from browsers to attacker-controlled domains with prior visits to the Revive Adserver admin panel
Monitoring Recommendations
- Enable verbose HTTP request logging on the Revive Adserver web tier and forward logs to a centralized analytics platform
- Alert on anomalous parameter values and long URL query strings targeting administrative PHP endpoints
- Track authentication events and administrative configuration changes for correlation with suspicious link clicks
How to Mitigate CVE-2025-27208
Immediate Actions Required
- Upgrade Revive Adserver to the latest patched release published after version 5.5.2
- Restrict access to the Revive Adserver administrative interface using IP allow-lists or VPN gating
- Educate administrative users to avoid clicking untrusted links that reference the ad server domain
Patch Information
Revive Adserver users should apply the vendor-released update that addresses the reflected XSS in admin-search.php. Refer to the HackerOne Vulnerability Report and the Full Disclosure Security Posting for coordinated disclosure details and remediation guidance.
Workarounds
- Deploy a WAF rule that blocks or sanitizes compact parameter values containing HTML or script metacharacters when routed to admin-search.php
- Enforce a strict Content Security Policy (CSP) that disallows inline scripts and restricts script sources to trusted origins
- Set the HttpOnly and SameSite=Strict attributes on session cookies to reduce the impact of reflected script execution
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
