OpenX Source archive backdoored

OpenX sat between publishers, advertisers, and every visitor who loaded an ad slot. In 2013, heise Security found that official OpenX Source 2.8.10 downloads from the project server contained a hidden PHP execution path. The compromised ZIP, tar.gz, and tar.bz2 archives came from the trusted download channel, and the backdoor did not sit in plain view inside them: it rode in a nested archive, openx-2.8.10/etc/plugins/openXVideoAds.zip, the plugin bundle that a normal installation unpacks.

The attacker hid PHP inside flowplayer-3.1.1.min.js, a JavaScript file nested under the video ads plugin. That file alone would have been inert, because web servers do not hand .js files to the PHP interpreter. Three files were modified, not one. In player.delivery.php, the echo file_get_contents() call that 2.8.9 and 2.8.11 used to serve the player became MAX_commonReadFile(). In lib/max/Delivery/common.php, the attacker injected the function that call now resolved to: function MAX_commonReadFile($arg) { if($conf['debug']['read']){ echo file_get_contents($arg); } require_once($arg); }. That second edit is what converted a read into an include, turning an innocuous-looking asset into server-side code. Rapid7 later described exploitation as a single request with a ROT13-encoded and reversed payload.

The backdoor was already being used against ad servers. Heise confirmed it in a download from November 2012, put its own body text at "at least three quarters of a year" unnoticed, and summarized that as almost a year; Rapid7 dated the exposure from at least November 2012 through August 2013, the roughly nine-month window recorded here. OpenX 2.8.10 was the current open-source release, so administrators who installed or refreshed the package during the window could inherit the backdoor as part of ordinary deployment.

Remediation required more than removing one line. Acunetix and other advisories recommended upgrading to OpenX 2.8.11 or later, auditing the server for prior compromise, rotating credentials and API keys, and considering a clean reinstall if exploitation evidence existed. A compromised ad server could also deliver attacks to site visitors.