Description
Vvveb 1.0.8.6 contains an incomplete server-side request forgery fix that allows authenticated admin users to bypass DNS pinning by requesting non-443 URLs. Attackers can supply a rebinding hostname to the editor oEmbedProxy url parameter to read loopback services, internal panels, and cloud metadata credentials.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| givanz | Vvveb | 1.0.8.6 – < 1.0.9.0 | 1.0.9.0 |
References
- GitHub Security Advisory (GHSA-42hc-694f-hcqm) vendor-advisory
- VulnCheck Advisory: Vvveb 1.0.8.6 SSRF via oEmbed Proxy DNS Rebinding third-party-advisory