CVE-2025-52667: Revive Adserver Stored XSS Vulnerability

CVE-2025-52667 Overview

CVE-2025-52667 is a stored cross-site scripting (XSS) vulnerability in Revive Adserver, an open-source ad management platform. The flaw exists in versions 6.0.1 and 5.5.2 and earlier. A script in the application fails to set a JSON Content-Type header on its response. Browsers can then interpret the response body as HTML, enabling stored XSS execution against authenticated manager users. Exploitation requires low-privileged access and user interaction, and the vulnerability is classified under [CWE-79].

Critical Impact

An authenticated attacker can store malicious payloads that execute in a manager's browser session, leading to session compromise and unauthorized actions on the ad server.

Affected Products

• Revive Adserver 6.0.1 and earlier 6.x releases
• Revive Adserver 5.5.2 and earlier 5.x releases
• Deployments hosting the affected script without a corrected Content-Type header

Discovery Timeline

• 2025-11-20 - CVE-2025-52667 published to the National Vulnerability Database
• 2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-52667

Vulnerability Analysis

The vulnerability stems from an HTTP response that returns JSON-formatted data without declaring Content-Type: application/json. When a browser receives content without an explicit MIME type, it performs content sniffing. If the response contains HTML-like markup, the browser can render it as HTML instead of treating it as data.

An authenticated user with manager privileges can inject a payload that is later reflected in the affected script's response. Because the response is rendered in the browser context of another manager, embedded JavaScript executes with that user's session. The impact is scoped to confidentiality and integrity within the ad server, with a changed security scope reflecting propagation across the trust boundary between stored data and the rendered admin UI.

Root Cause

The root cause is a missing HTTP response header. The affected endpoint returns structured JSON but omits the Content-Type: application/json declaration. Without this header, MIME sniffing allows browsers to interpret attacker-controlled fields as executable HTML and JavaScript. Combined with insufficient output encoding for stored user input, this permits script injection.

Attack Vector

Exploitation follows a standard stored XSS pattern. An attacker who already has manager-level access injects a crafted payload into a field consumed by the vulnerable script. When a second manager loads the affected view, the browser sniffs the response, renders the payload, and executes attacker-controlled JavaScript. Refer to the HackerOne Security Report #3399809 for reporter-provided technical details.

No verified proof-of-concept code has been published. Describing exploitation in prose only.

Detection Methods for CVE-2025-52667

Indicators of Compromise

• HTTP responses from Revive Adserver endpoints returning JSON bodies without a Content-Type: application/json header
• Manager-account activity that stores HTML tags, <script> fragments, or JavaScript event handlers into ad-related fields
• Unexpected outbound requests originating from admin browser sessions after loading Revive management pages

Detection Strategies

• Inspect web server and application logs for POST requests from manager accounts that contain HTML or JavaScript markup in form parameters
• Review response headers on affected scripts and flag any JSON payloads served without the correct MIME type
• Correlate admin authentication events with subsequent anomalous requests that could indicate session abuse

Monitoring Recommendations

• Enable web application firewall rules that inspect stored fields for XSS payload signatures
• Log and alert on Revive Adserver administrative actions performed shortly after unusual field updates
• Monitor browser telemetry from admin workstations for script execution originating from the Revive domain

How to Mitigate CVE-2025-52667

Immediate Actions Required

• Upgrade Revive Adserver to a fixed release beyond 6.0.1 and 5.5.2 as published by the maintainers
• Restrict manager account provisioning and audit existing manager accounts for unauthorized entries
• Review stored ad and campaign fields for injected HTML or JavaScript and remove suspicious content

Patch Information

The vendor addresses the issue by setting the Content-Type: application/json header on the affected script and hardening output handling. Consult the HackerOne Security Report #3399809 and the Revive Adserver release notes for the specific patched version applicable to your deployment branch.

Workarounds

• Configure the web server to force Content-Type: application/json and X-Content-Type-Options: nosniff on responses from the affected script
• Apply a Content Security Policy that blocks inline script execution in the Revive admin interface
• Limit manager role assignments to trusted operators until the patch is deployed

# Example nginx configuration to prevent MIME sniffing on Revive admin responses
location /www/admin/ {
    add_header X-Content-Type-Options "nosniff" always;
    add_header Content-Security-Policy "default-src 'self'; script-src 'self'" always;
}