CyberRota Analysis
AI-GeneratedThe kkFileView application, prior to version 5.0.1, contains a vulnerability in its unauthenticated GET /addTask endpoint, which is not properly filtered, allowing attackers to exploit the FileConvertQueueTask to fetch arbitrary URLs. This could lead to unauthorized access to sensitive files or data manipulation, particularly affecting users of Office, Java, and related file types. Organizations utilizing kkFileView should prioritize updating to version 5.0.1 to mitigate potential security risks.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
kkFileView is a universal file online preview project based on Spring Boot. Prior to 5.0.1, the unauthenticated GET /addTask endpoint in kkFileView is omitted from TrustHostFilter and TrustDirFilter in server/src/main/java/cn/keking/config/WebConfig.java, allowing FileConvertQueueTask to fetch an attacker-selected URL after FileHandlerService#getFileAttribute uses the fullfilename parameter to force an OFFICE, COMPRESS, or CAD type. This issue is fixed in version 5.0.1.