iDocView SSRF via /doc/upload Endpoint Hardcoded Token
60Vexday Risk Score
Prioritize patching. It exploitation observed by VulnCheck and has a public proof of concept.
ssvc Actcvss 8.7
from disclosure to weapon
Published on NVDSep 30
VulnCheckSep 30
exploitation probability
—
observed exploitation
yesVulnCheck
1 public exploit(s)
iDocView contains a server-side request forgery vulnerability in its /doc/upload endpoint that allows remote unauthenticated attackers to fetch arbitrary URLs by supplying a hardcoded default token value (testtoken) to bypass authentication. Attackers can exploit the unrestricted URL scheme handling, including file:// URIs, to read arbitrary local files such as operating-system and application configuration files, and to reach internal network hosts and services not otherwise accessible. Exploitation evidence was first observed by the Shadowserver Foundation on 2024-03-26.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Affected products
iDocView · iDocViewpublic PoCs found — 1
cve_referenceblog.csdn.net/qq_41904294/article/details/134995343unverified⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.