Givanz VvvebJs Server-Side Request Forgery and Arbitrary File Read Vulnerability

A critical vulnerability in Givanz VvvebJs version 1.7.2 allows for Server-Side Request Forgery (SSRF) and arbitrary file reading. This issue arises from improper handling of user-supplied URLs in the 'file_get_contents' function within 'save.php'.

Impact

Exploitation of this vulnerability allows attackers to read arbitrary files on the server and execute internal requests.

Reproduction

To reproduce this vulnerability, send a request to 'save.php' with the 'action' parameter set to 'oembedProxy' and the 'url' parameter set to a file path, such as '/etc/passwd'. The response will contain the contents of the specified file, demonstrating the arbitrary file read capability. Additionally, internal requests can be made by setting the 'url' parameter to 'http://127.0.0.1', which will proxy the response from the local server.