Vvveb Server-Side Request Forgery Vulnerability in oEmbedProxy Action

A server-side request forgery (SSRF) vulnerability has been identified in Vvveb versions prior to 1.0.8.1. The issue arises in the oEmbedProxy action of the editor module, where the url parameter is sent directly to the getUrl() function via cURL, lacking proper validation of the scheme or destination. This vulnerability allows authenticated backend users to provide file:// URLs to access arbitrary files that the web server can read, or http:// URLs that target internal network addresses to probe local services, with the response bodies returned directly to the requester.

Impact

Exploitation of this vulnerability allows for server-side request forgery, enabling authenticated users to read arbitrary files from the server or probe internal services.

Remediation

Users can update to Vvveb version 1.0.8.1 or later, where this vulnerability has been fixed.