Vulnerability record · CVE-2019-5434 · published 6 May 2019
CVE-2019-5434: Revive Adserver XML-RPC unserialize() PHP object injection
RRevive Sas · Revive Adserver
Revive Adserver passes the "what" parameter of the openads.spc XML-RPC method into unserialize() without validating it, allowing PHP object injection and exploitation of serialize-related PHP flaws. The vendor fixed it in 4.2.0, and the report notes it may have been used to compromise instances and serve malware to third-party sites.
Description
An attacker could send a specifically crafted payload to the XML-RPC invocation script and trigger the unserialize() call on the "what" parameter in the "openads.spc" RPC method. Such vulnerability could be used to perform various types of attacks, e.g. exploit serialize-related PHP vulnerabilities or PHP object injection. It is possible, although unconfirmed, that the vulnerability has been used by some attackers in order to gain access to some Revive Adserver instances and deliver malware through them to third party websites. This vulnerability was addressed in version 4.2.0.
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Automated analysis
critical priorityUnauthenticated network-reachable PHP object injection with CVSS 9.8 and high EPSS, plus public RCE references and suspected real-world abuse.
What it is
Revive Adserver passes the "what" parameter of the openads.spc XML-RPC method into unserialize() without validating it, allowing PHP object injection and exploitation of serialize-related PHP flaws. The vendor fixed it in 4.2.0, and the report notes it may have been used to compromise instances and serve malware to third-party sites.
Impact
An unauthenticated attacker can execute code or otherwise fully compromise the ad server, then use it to inject malicious content into ads served to third-party websites.
Attack surface
Reached over the network through the XML-RPC invocation script by sending a crafted payload to the openads.spc method; the CVSS vector shows no privileges or user interaction required.
Exploitation
Not listed in CISA KEV, but EPSS is 0.57 (99th percentile) and public references include a Packet Storm remote code execution writeup, indicating active interest and likely exploit availability.
What to do
- Upgrade Revive Adserver to 4.2.0 or later immediately.
- If upgrade is not possible, disable or block external access to the XML-RPC endpoint.
- Restrict network access to the ad server admin and RPC interfaces to trusted IPs.
- Review PHP configuration and disable dangerous unserialize gadget classes where feasible.
- Audit the instance for signs of compromise and rotate credentials and secrets.
Detection
- Monitor XML-RPC requests for the openads.spc method and unusual "what" parameter values.
- Alert on POST bodies containing serialized PHP object patterns (O:, a:, s:) to RPC endpoints.
- Watch for unexpected outbound connections or injected content in served ads.
- Review web and PHP logs for errors or anomalies around XML-RPC invocation scripts.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Affected products
1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
| Link | Tags |
|---|---|
| http://packetstormsecurity.com/files/155559/Revive-Adserver-4.2-Remote-Code-Execution.html | |
| https://hackerone.com/reports/512076 | Third Party Advisory |
| https://hackerone.com/reports/542670 | Third Party Advisory |
| https://www.revive-adserver.com/security/revive-sa-2019-001/ | Vendor Advisory |
| http://packetstormsecurity.com/files/155559/Revive-Adserver-4.2-Remote-Code-Execution.html | |
| https://hackerone.com/reports/512076 | Third Party Advisory |
| https://hackerone.com/reports/542670 | Third Party Advisory |
| https://www.revive-adserver.com/security/revive-sa-2019-001/ | Vendor Advisory |
Track CVE-2019-5434 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2019-5434), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.
