CVE-2024-29272: 
JavaScript vulnerability analysis and mitigation

CVE-2024-29272 is an Arbitrary File Upload vulnerability affecting VvvebJs versions before 1.7.5. The vulnerability allows unauthenticated remote attackers to execute arbitrary code and obtain sensitive information via the sanitizeFileName parameter in save.php. The vulnerability was discovered and disclosed on March 22, 2024 (NVD).

The vulnerability exists in the save.php file where the sanitizeFileName function fails to implement adequate checks on uploaded files. The function is designed to remove unsecured characters and parameters from filenames but fails to validate user input properly. The CVSS v3.1 base score is 6.5 (Medium) with vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N (NVD).

An attacker can exploit this vulnerability to upload malicious files onto the server, potentially leading to the execution of arbitrary code under the context of the webserver. Successful exploitation could allow attackers to upload any type of files, including malicious PHP scripts or web shells, enabling unauthorized access to sensitive data or privilege escalation on the server (Github Issue).

The vulnerability is exploitable by sending a specially crafted POST request to save.php with a malicious file parameter. No authentication is required to exploit this vulnerability, making it particularly dangerous. The vulnerability has been demonstrated through a proof of concept that shows how an attacker can upload PHP files to the server (Github Issue).

The vulnerability has been patched in VvvebJs version 1.7.5. The fix includes improved input validation and file type checking in the sanitizeFileName function. Users are strongly recommended to upgrade to version 1.7.5 or later (Github Commit).