CyberRota Analysis
AI-GeneratedVvveb CMS versions prior to 1.0.8.6 are vulnerable to a Server-Side Request Forgery (SSRF) flaw that allows authenticated admin users to access internal services and cloud metadata by exploiting IPv6 addresses or domains with only AAAA records. This vulnerability can lead to the exposure of sensitive information, including IAM credentials, posing a significant risk to organizations using this CMS. Administrators of affected Vvveb installations should prioritize upgrading to the patched version to mitigate potential security breaches.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to version 1.0.8.6, Vvveb's SSRF guard resolves a host with an IPv4-only function and never inspects IPv6, so any host that lacks an A record passes a private-range check. Editor oEmbed proxy fetches an attacker-supplied URL server side and reflects a response body, so an authenticated admin-panel user (default role site_admin or higher) can read internal-only services and cloud metadata, including IAM credentials, using an IPv6 literal or a domain that carries only an AAAA record. This issue has been patched in version 1.0.8.6.