External risk intelligence

VvvebJs File Upload Vulnerability in save.php

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2024-25182

VvvebJs is a drag-and-drop website builder designed to create web pages. As a web-based application, it is commonly deployed as a web-facing service to facilitate content management and site editing. Because it is a web application meant for online interaction, it is commonly exposed as an internet-facing service.

Unrestricted File Upload

Vvvebjs

1.7.2

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory highlights a critical vulnerability in the VvvebJs website builder, specifically related to file uploads. The flaw could allow unauthorized access and manipulation of web content. The main concern is confirming relevance and exposure of VvvebJs within the organization's environment.

Vulnerability allows unauthenticated file uploads.
Critical flaw impacts website builder technology.
Confirm VvvebJs presence and assess exposure.

Attack Path

How an attacker could exploit the issue

An attacker can reach the vulnerable component by uploading a file through the `save.php` script in VvvebJs. This vulnerability allows an unauthenticated attacker to upload arbitrary files, potentially leading to remote code execution or other severe impacts on the server.

No authentication required to access.
Upload a file via `save.php`.
Full server compromise possible.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability in VvvebJs, when running version 1.7.2, could allow an unauthenticated attacker to upload arbitrary files to the server via the save.php endpoint. This could lead to the execution of malicious code or the modification of website content, depending on the server's configuration and how the uploaded file is handled.

Arbitrary code execution or website defacement.
Unauthenticated file upload via save.php.
Compromise of website integrity and availability.

Operational Fix

Recommended remediation, mitigation, and detection steps

This advisory impacts the VvvebJs web builder. The platform or web infrastructure team, alongside application owners, should take the lead in identifying and managing this vulnerability. The immediate first step is to locate all instances of VvvebJs, determine their exposure, and assess their criticality to business operations to prioritize remediation efforts.

Own by Platform or Web Infrastructure Team.
Verify VvvebJs instances and exposure.
Plan remediation based on assessed risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is VvvebJs?

VvvebJs is a drag-and-drop website builder application. Users utilize this software to design and manage web pages visually. Because it is a web-based tool, it is frequently deployed on servers to enable remote content editing and site development.

How does CVE-2024-25182 affect the software?

This vulnerability is classified as CWE-434, or Unrestricted Upload of File with Dangerous Type. It means the application fails to properly validate files before saving them to the server, allowing an attacker to upload arbitrary files that could compromise the system.

Do I need to be logged in to trigger this bug?

No. The vulnerability exists within the save.php script and does not require authentication to access. Simply sending a request to this endpoint is sufficient to attempt an upload. Legitimate administrative actions that do not interact with this specific file upload process do not trigger the flaw.

Is my instance of VvvebJs at risk?

Halo Surface Signal indicates that because VvvebJs is a web application designed for online editing, it is commonly exposed as an internet-facing service. If your installation is accessible via the public internet, it faces a higher likelihood of being reachable by unauthorized parties compared to internal-only systems.

What are the first steps to address this vulnerability?

Begin by auditing your infrastructure to create a complete inventory of all running VvvebJs instances. Once located, evaluate the network accessibility of each deployment to determine its exposure level. Prioritize these findings based on business criticality to plan your path forward.

References

gist.github.com/joaoviictorti/ff6220d8ed6df77a0420f4413a1d9b8d

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.