CVE-2022-43140

HIGHNuclei

kkFileView 4.1.0 - Server-Side Request Forgery

Title source: github.com
STIX 2.1 vulnerability

Record summary

CVE-2022-43140 has a selected CVSS score of 7.5 (high); EIP currently links 1 Nuclei template.

Description

kkFileView v4.1.0 was discovered to contain a Server-Side Request Forgery (SSRF) via the component cn.keking.web.controller.OnlinePreviewController#getCorsFile. This vulnerability allows attackers to force the application to make arbitrary requests via injection of crafted URLs into the url parameter.

Description source: CVE List

Exploitation context

Available material

Nuclei templates
1

CISA SSVC decision

ExploitationPoC
AutomatableYes
Technical impactPartial

CISA Coordinator · SSVC 2.0.3 · Evaluated Apr 30, 2025 · Source: CVE List

Nuclei templates

1
ProjectDiscoveryHIGHkkFileView 4.1.0 - Server-Side Request ForgeryCVSS 7.5

kkFileView 4.1.0 is susceptible to server-side request forgery via the component cn.keking.web.controller.OnlinePreviewController#getCorsFile. An attacker can force the application to make arbitrary requests via injection of crafted URLs into the url parameter and thereby potentially obtain sensitive information, modify data, and/or execute unauthorized administrative operations in the context of the affected site.

Impact

Successful exploitation of this vulnerability could lead to unauthorized access to internal resources, potential data leakage, and further attacks on the server.

Remediation

Apply the latest security patches or updates provided by the vendor to fix the SSRF vulnerability in kkFileView 4.1.0.

WeaknessesCWE-918
AuthorsCo5mos
Template tagscve2022cvessrfkkFileviewkekingvuln
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
CPE: cpe:2.3:a:keking:kkfileview:4.1.0:*:*:*:*:*:*:*
Shodan: http.html:"kkFileView"
Shodan: http.html:"kkfileview"
FOFA: app="kkFileView"
FOFA: app="kkfileview"
FOFA: body="kkfileview"
https://github.com/kekingcn/kkFileView/issues/392 https://nvd.nist.gov/vuln/detail/CVE-2022-43140

Source: ProjectDiscovery

References

2