CVE-2022-42149

CRITICALNuclei

kkFileView 4.0 - Server-Side Request Forgery

Title source: github.com
STIX 2.1 vulnerability

Record summary

CVE-2022-42149 has a selected CVSS score of 9.8 (critical); EIP currently links 1 Nuclei template.

Description

kkFileView 4.0 is vulnerable to Server-side request forgery (SSRF) via controller\OnlinePreviewController.java.

Description source: CVE List

Exploitation context

Available material

Nuclei templates
1

CISA SSVC decision

ExploitationPoC
AutomatableNo
Technical impactPartial

CISA Coordinator · SSVC 2.0.3 · Evaluated May 14, 2025 · Source: CVE List

Nuclei templates

1
ProjectDiscoveryCRITICALkkFileView 4.0 - Server-Side Request ForgeryCVSS 9.8

kkFileView 4.0 contains a server-side request forgery caused by improper validation in OnlinePreviewController.java, letting attackers induce the server to make arbitrary requests, exploit requires sending crafted requests.

Impact

Unauthenticated attackers can exploit SSRF to make the server fetch arbitrary URLs, potentially accessing internal services, bypassing firewall restrictions, and exfiltrating sensitive data from internal networks.

Remediation

Update kkFileView to a version newer than 4.0 that properly validates URL parameters and restricts requests to trusted sources.

WeaknessesCWE-918
AuthorsArm!tage
Template tagscvecve2022ssrfkkfileviewkekingvuln
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CPE: cpe:2.3:a:keking:kkfileview:*:*:*:*:*:*:*:*
Shodan: http.html:"kkFileView"
Shodan: http.html:"kkfileview"
FOFA: app="kkFileView"
FOFA: app="kkfileview"
FOFA: body="kkfileview"
https://github.com/kekingcn/kkFileView/issues/296 https://nvd.nist.gov/vuln/detail/CVE-2022-42149

Source: ProjectDiscovery

References

2