CVE-2022-43140
Published: 17 November 2022
Summary
CVE-2022-43140 is a high-severity SSRF (CWE-918) vulnerability in Keking Kkfileview. Its CVSS base score is 7.5 (High).
Operationally, ranked in the top 3.2% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Deeper analysis
kkFileView version 4.1.0 contains a server-side request forgery vulnerability in the OnlinePreviewController#getCorsFile component. The flaw is triggered when an attacker supplies a crafted value to the url parameter, causing the application to issue arbitrary outbound requests. The issue is tracked as CWE-918 and received a CVSS 3.1 score of 7.5 reflecting network attack vector, low complexity, and no required authentication or user interaction.
Unauthenticated remote attackers can exploit the vulnerability to force the kkFileView server to retrieve attacker-controlled URLs. Successful exploitation can result in high-integrity impact such as internal network scanning, access to otherwise unreachable resources, or interaction with internal services that trust the kkFileView host.
Public references consist of GitHub issue 392, which documents the discovery and reproduction steps but does not include an official patch announcement or mitigation guidance in the supplied references.
EPSS for the CVE rose from lower values to a peak of 0.7926 on 2025-12-11 before receding to the current score of 0.3081, indicating a period of heightened exploitation interest after disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2022-46186
Vulnerability details
kkFileView v4.1.0 was discovered to contain a Server-Side Request Forgery (SSRF) via the component cn.keking.web.controller.OnlinePreviewController#getCorsFile. This vulnerability allows attackers to force the application to make arbitrary requests via injection of crafted URLs into the url parameter.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Penetration testing attempts server-side requests to internal resources, identifying SSRF weaknesses for remediation.
Outbound connections to external resources can be monitored and limited at the boundary, reducing SSRF impact.
Validates server-side URLs and resource references to block SSRF attempts.
Detects server-side request forgery through monitoring of unexpected outbound connections.