Davide Reggiani

**Name of the Vulnerable Software and Affected Versions** Vedo Suite version 2024.17 **Description** A path traversal issue exists in Vedo Suite 2024.17 that may allow remote authenticated attackers to read arbitrary filesystem files. The issue is due to an unsanitized `file get contents()` function call within the `/api vedo/template` API endpoint. **Recommendations** As a temporary workaround, consider restricting access to the `/api vedo/template` API endpoint until a fix is available.

**Name of the Vulnerable Software and Affected Versions** Vedo Suite version 2024.17 **Description** A Cross-site scripting (XSS) vulnerability exists in the `/api vedo/` API endpoint of Vedo Suite. This allows remote attackers to inject arbitrary Javascript or HTML code, potentially leading to code execution in the victim’s browser. **Recommendations** As a temporary workaround, consider restricting access to the `/api vedo/` API endpoint until a fix is available.

**Name of the Vulnerable Software and Affected Versions** Vedo Suite version 2024.17 **Description** Vedo Suite 2024.17 is susceptible to an incorrect access control issue. This allows remote attackers to obtain a valid, high-privilege JWT (JSON Web Token) without authentication by sending an empty HTTP POST request to the `/autologin/` API endpoint. **Recommendations** Vedo Suite version 2024.17: Implement proper authentication and authorization checks for the `/autologin/` API endpoint to prevent unauthorized access and JWT token generation.

**Name of the Vulnerable Software and Affected Versions** Vedo Suite version 2024.17 **Description** The application stores credentials in clear-text within the `/api vedo/configuration/config.yml` file. This file contains sensitive information, including credentials, secret keys, and database information. **Recommendations** Ensure the `/api vedo/configuration/config.yml` file is appropriately secured to prevent unauthorized access.

**Name of the Vulnerable Software and Affected Versions** Vedo Suite version 2024.17 **Description** An unrestricted file upload issue exists in Vedo Suite version 2024.17. Remote authenticated attackers can write to arbitrary filesystem paths by exploiting the insecure `uploadPreviews()` custom function in `/api vedo/colorways preview`, potentially leading to remote code execution (RCE). **Recommendations** As a temporary workaround, consider restricting access to the `/api vedo/colorways preview` API endpoint until a patch is available. Review and modify the `uploadPreviews()` function to implement proper file upload restrictions and sanitization.

**Name of the Vulnerable Software and Affected Versions** Bottinelli Informatical Vedo Suite version 2024.17 **Description** Bottinelli Informatical Vedo Suite 2024.17 is vulnerable to Server-side Request Forgery (SSRF) in the `/api vedo/video/preview` endpoint. This allows remote authenticated attackers to trigger HTTP requests towards arbitrary remote paths via the `file` URL parameter. **Recommendations** Restrict access to the `/api vedo/video/preview` endpoint. Sanitize or validate the `file` URL parameter to prevent requests to arbitrary remote paths.