XSS/HTMLi in Adform Site Tracking v1.1 - CVE-2025-50891 
=======================================================

Product: Adform Site Tracking (track.adform.net)
Version: v1.1
Vendor: Adform


Description
-----------
Adform Site Tracking is used to collect user data from websites and apps. The data includes visitors' behavior, activity, intent, or interest signals, which can help you understand your audience better and contribute to data-driven business decisions.

An HTML script tag pointing to "https://track.adform.net/Serving/Cookie/?adfaction=getjs;adfcookname=uid" is embedded in the web app's HTML code for requesting JS code that sets a unique user ID (_uid) for the Adform object in the global window scope, initializing Adform if it doesn't already exis.

	<script id="mainThread" text="" charset="" type="text/javascript" src="https://track.adform.net/Serving/Cookie/?adfaction=getjs;adfcookname=uid"></script>


So, when requesting the endpoint "https://track.adform.net/Serving/Cookie/?adfaction=getjs;adfcookname=uid" via HTTP GET method, the "Cookie" header's "uid" parameter is affected by Reflective Cross-Site Scripting (XSS) vulnerability where malicious JS payload can be injected and immediately reflected back in the HTTP response (Content-Type: text/javascript; charset=utf-8) as part of a JS code. 

	Original Response:
	(function(){var _w=window;_w.Adform=_w.Adform||{};_w.Adform._uid='123456789';})();


Then, the malicious JS payload will be executed in the context of the targeted application since this code is retrieved using the script tag embedded in its source code.

	Malicious Response:
	function(){var _w=window;_w.Adform=_w.Adform||{};_w.Adform._uid='12345';});<script>alert("XSS")</script>({'6789';})();


Note: The cookie value only applies secure flag as protection. This doesn't prevent attacks like the one described in the following scenario.


Scenario
--------
1. The attacker crafts a malicious webpage with JavaScript that makes a cross-site request to the target application. This malicious page includes code that sets a poisoned cookie for adform.net with a malicious JavaScript payload as part of the cookie value. This is essentially injecting arbitrary JS code into the cookie value.

2. The victim visits the malicious page, which causes the JavaScript on the malicious page to set the poisoned cookie in the victim’s browser. This cookie has been tampered with to include malicious JavaScript within the value.

3. The next time the Adform script is executed in the targeted app, the browser makes a request to the "https://track.adform.net/Serving/Cookie/?adfaction=getjs;adfcookname=uid", which includes the poisoned cookie that contains the malicious JS payload.

4. Then, the Adform server replies with JS code (including malicious JS payload), which is executed in the context of the targeted app.



Risk
----
This security issue can affect any application that makes use of this 3rd party service and it can lead to JS arbitrary code allowing session hijacking, credential theft, unauthorized actions, etc.



Risk Mitigations
----------------
1. Sanitize input data before embedding it into JS responses.
2. Enable HttpOnly flag. It prevents JavaScript access to sensitive cookies.