CVE-2020-8143: Revive Adserver open redirect via returnurl parameter

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: high.

medium priorityThe flaw is a medium-severity open redirect requiring authenticated user interaction, but public exploit detail and a high EPSS score raise the likelihood of phishing abuse.

What it is

Revive Adserver before 5.0.5 contains an open redirect in the admin interface. A crafted link can redirect a logged-in user to an arbitrary destination through the returnurl GET parameter, and CSRF protection on /www/admin/*-modify.php can be bypassed when no meaningful parameter is sent. This matters because it enables convincing phishing redirects that appear to originate from a trusted ad server domain.

Impact

An attacker can redirect a logged-in administrator to an attacker-controlled site, supporting credential phishing or malware delivery under the guise of the trusted Revive Adserver origin. No direct data modification or code execution is gained from the redirect itself.

Attack surface

Reached over the network via a crafted URL containing the returnurl parameter; the victim must be authenticated and must click the link, so user interaction is required. No privileges are needed by the attacker.

Exploitation

Not listed in CISA KEV, but EPSS is high at roughly 0.70 (99th percentile) and the HackerOne report is tagged Exploit, indicating public proof-of-concept detail exists. No ransomware usage is documented.

What to do

• Upgrade Revive Adserver to 5.0.5 or later, which addresses this issue per the vendor advisory.
• Validate and allowlist redirect destinations for the returnurl parameter instead of accepting arbitrary URLs.
• Enforce CSRF token checks on /www/admin/*-modify.php even when no meaningful parameters are submitted.
• Warn or train admin users not to follow unexpected links to the ad server admin panel.

Detection

• Review web logs for requests to /www/admin/*-modify.php with a returnurl parameter pointing to external domains.
• Alert on admin-panel requests where the returnurl value is an absolute URL outside the organization's own domains.
• Monitor for redirect chains from the Revive Adserver host to unfamiliar external sites in proxy or DNS logs.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.