An unauthenticated SSRF vulnerability in kkFileView allows attackers to bypass security filters and perform unauthorized server-side requests, posing a critical risk of internal data exposure.

The application is vulnerable to SSRF due to a mismatch between the parameter validated by the TrustHostFilter and the parameter processed by the /getCorsFile controller. An unauthenticated attacker can supply a whitelisted decoy URL to pass the filter while simultaneously providing an unvalidated malicious target URL that the server proceeds to fetch.

Successful exploitation of this vulnerability permits an attacker to interact with internal network services that are otherwise protected from the public internet. This can lead to the exfiltration of sensitive internal data, unauthorized interaction with internal APIs, and significant reputational damage. Given the CVSS score of 9.1, this vulnerability is classified as critical and should be treated as a high priority for remediation.

Immediate Action: Since a specific patch version is not currently available, administrators should restrict network access to the kkFileView instance, ensuring it cannot reach sensitive internal systems.

Proactive Monitoring: Review web server and application access logs for requests to the /getCorsFile endpoint containing multiple URL-related parameters, particularly those involving internal IP addresses or private hostnames.

Compensating Controls: Deploy or update Web Application Firewall rules to strictly inspect and normalize request parameters, blocking any traffic that attempts to pass multiple URL parameters simultaneously to the same endpoint.

Public Exploit Available: Unknown.

The critical nature of this SSRF vulnerability necessitates immediate defensive action. Security teams must prioritize network isolation for the affected application and implement strict request filtering until an official security update is released by the vendor to correct the parameter validation logic.