New RCE Found in kkFileView – Patch Still Pending

> About Author
Hi, I'm Sharon, a product manager at Chaitin Tech. We build SafeLine, an open-source Web Application Firewall built for real-world threats. While SafeLine focuses on HTTP-layer protection, our emergency response center monitors and responds to RCE and authentication vulnerabilities across the stack to help developers stay safe.

kkFileView is a popular open-source project that allows users to preview various file formats directly in the browser.

In April 2024, a critical remote code execution (RCE) vulnerability was publicly disclosed. The flaw allows attackers to upload specially crafted ZIP files that overwrite system files and execute arbitrary code on the server.

Vulnerability Overview

What Happened?

The issue was introduced in version 4.2.0, when the file upload logic was changed to extract both file names and directory paths from ZIP files. This opened the door to a classic Zip Slip vulnerability.

By uploading a malicious ZIP archive containing files with directory traversal sequences (../../), an attacker can overwrite sensitive files on the server and trigger code execution.

Impact

If exploited successfully, this vulnerability could:

• Allow full remote code execution (RCE)
• Lead to complete server takeover
• Leak sensitive files or credentials
• Turn your server into a launchpad for further attacks

Affected Versions

The following versions are confirmed to be vulnerable:

• kkFileView v4.2.0 through v4.4.0-beta

⚠️ At the time of writing, no official release has patched the issue. A fix is available on the development branch and will be merged in the next official release.

Workaround & Temporary Fixes

If you're using kkFileView in production, here’s what you can do immediately:

1. Disable File Uploads: Add the following configuration to application.properties:

   file.upload.disable=true

This will disable the upload feature on the homepage.

1. Restrict Network Access:

   • Avoid exposing the application to the public internet.
   • Use firewall rules or ACLs to allow access only from trusted IP addresses.

2. Monitor for Malicious Uploads:

   • Check for unusual .zip files or unexpected files in your server directories.

Patch Status

The issue was fixed in this GitHub commit, but the patched code is currently only in the development branch.

For now, users are advised to:

• Pull the latest code from the dev branch
• Follow the project for updates on the next official release
• Stay alert for security bulletins

Reproduction

The vulnerability can be reproduced by uploading a ZIP file with a payload like:

../tomcat/webapps/ROOT/shell.jsp

If extracted without sanitization, this will place a web shell directly into your server's public directory.

Detection Support

Timeline

• April 16, 2024 – Vulnerability intelligence surfaced
• April 17, 2024 – Official fix committed to development branch
• April 17, 2024 – Security advisory published by Chaitin Tech

References

• kkFileView GitHub Project
• Fix Commit on GitHub

Join the SafeLine Community

• GitHub Repository
• Official Docs
• Discord Community

Final Thoughts

If you're running kkFileView in any public or internal environment, take action now. The exploit is trivial, the impact is high, and a proper patch is still pending.

Disable uploads, restrict access, and monitor logs while waiting for the next stable release.

Stay safe out there.