CVE-2024-29271: Vvveb Vvvebjs XSS Vulnerability

CVE-2024-29271 Overview

CVE-2024-29271 is a reflected Cross-Site Scripting (XSS) vulnerability in VvvebJs, an open-source drag-and-drop website builder. The flaw affects all versions prior to 1.7.7 and resides in the action parameter of save.php. An attacker can craft a malicious URL that, when visited by an authenticated user, executes arbitrary JavaScript in the victim's browser context. This enables session theft, credential harvesting, and unauthorized actions against the VvvebJs backend. The vulnerability is tracked under CWE-79: Improper Neutralization of Input During Web Page Generation.

Critical Impact

Remote attackers can execute arbitrary JavaScript in a victim's browser session and exfiltrate sensitive information from the VvvebJs administrative interface.

Affected Products

• VvvebJs versions prior to 1.7.7
• The vulnerable component is save.php
• Deployments exposing the VvvebJs editor to untrusted users

Discovery Timeline

• 2024-03-22 - CVE-2024-29271 published to the National Vulnerability Database (NVD)
• 2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-29271

Vulnerability Analysis

The vulnerability exists in save.php, which reads the action HTTP GET parameter and reflects it back into server-side output without sanitization. Because the value is rendered in a response context without encoding, an attacker-controlled payload is interpreted as HTML or JavaScript by the browser. Exploitation requires user interaction, typically clicking a crafted link, and the impact crosses security scopes by executing scripts under the trusted VvvebJs origin.

A successful attack allows adversaries to steal session cookies, perform actions on behalf of authenticated editors, or deface content served through the website builder. The scope change inherent to reflected XSS also permits pivoting toward other same-origin resources exposed by the application.

Root Cause

The root cause is the absence of output encoding on the $_GET['action'] value before it is used in response generation. User input flows directly from the request into the HTTP response, satisfying the conditions for reflected XSS defined in CWE-79.

Attack Vector

Exploitation is remote and requires no authentication on the attacker's side. The adversary crafts a URL to save.php embedding a JavaScript payload in the action parameter and delivers it via phishing, forum posts, or chat. When a victim with an active VvvebJs session clicks the link, the script executes in the context of the VvvebJs origin.

// Security patch applied in save.php
if (isset($_GET['action'])) {
-    $action = $_GET['action'];
+    $action = htmlspecialchars(strip_tags($_GET['action']));
}

if ($action) {
    // ... downstream processing
}

Source: VvvebJs commit c0c0545. The patch sanitizes the action parameter by stripping HTML tags and encoding special characters with htmlspecialchars() before any downstream use.

Detection Methods for CVE-2024-29271

Indicators of Compromise

• HTTP GET requests to save.php containing script tags, javascript: URIs, or encoded payloads in the action parameter
• Referer headers originating from external, untrusted domains linking directly to save.php
• Unexpected outbound requests from editor sessions to attacker-controlled hosts following page loads of save.php
• Browser console errors or Content Security Policy violation reports tied to the VvvebJs origin

Detection Strategies

• Deploy web application firewall (WAF) rules that inspect query strings for XSS signatures such as <script, onerror=, and javascript: on paths matching /save.php
• Enable server-side request logging and alert on action parameter values containing HTML metacharacters or percent-encoded script fragments
• Correlate suspicious save.php requests with downstream anomalous session activity, including unexpected administrative actions

Monitoring Recommendations

• Review historical access logs for save.php requests containing non-alphanumeric values in the action parameter prior to patching
• Implement a strict Content Security Policy (CSP) and monitor report-uri endpoints for violations
• Track user-agent and geolocation anomalies on administrative sessions interacting with VvvebJs

How to Mitigate CVE-2024-29271

Immediate Actions Required

• Upgrade VvvebJs to version 1.7.7 or later, which includes the sanitization fix for the action parameter
• Restrict network access to VvvebJs administrative endpoints using authentication proxies or IP allowlists
• Invalidate active sessions and rotate credentials for users who may have clicked suspicious links referencing save.php

Patch Information

The fix is implemented in commit c0c0545 and shipped in VvvebJs 1.7.7. The patch wraps the action parameter with strip_tags() and htmlspecialchars() before any further use. Additional context is available in GitHub Issue #342.

Workarounds

• Apply the upstream sanitization logic manually to save.php if an immediate upgrade is not feasible
• Deploy a reverse proxy or WAF rule that blocks requests to save.php containing HTML special characters in the action query parameter
• Serve the VvvebJs application with a restrictive Content Security Policy that disallows inline scripts and unknown script sources

# Example nginx rule to block XSS payloads in the action parameter
location = /save.php {
    if ($arg_action ~* "(<|>|script|javascript:|onerror=)") {
        return 403;
    }
    # Pass through to PHP-FPM as usual
    include fastcgi_params;
    fastcgi_pass unix:/run/php/php-fpm.sock;
}