{"id":"CVE-2023-54402","published":"2026-09-30T21:16:51.980","lastModified":"2026-10-05T16:17:00.973","description":"iDocView contains a server-side request forgery vulnerability in its /doc/upload endpoint that allows remote unauthenticated attackers to fetch arbitrary URLs by supplying a hardcoded default token value (testtoken) to bypass authentication. Attackers can exploit the unrestricted URL scheme handling, including file:// URIs, to read arbitrary local files such as operating-system and application configuration files, and to reach internal network hosts and services not otherwise accessible. Exploitation evidence was first observed by the Shadowserver Foundation on 2024-03-26.","cvssScore":7.5,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","cwes":["CWE-918"],"vendors":[],"products":[],"references":[{"url":"https://blog.csdn.net/qq_41904294/article/details/134995343","tags":[]},{"url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/vulnerabilities/idoc/idocview-lfi.yaml","tags":[]},{"url":"https://www.vulncheck.com/advisories/idocview-ssrf-via-doc-upload-endpoint-hardcoded-token","tags":[]}],"exploitRefs":[{"url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/vulnerabilities/idoc/idocview-lfi.yaml","tags":[]}],"hasPoc":true,"ai":{"summary":"The iDocView application has a server-side request forgery vulnerability in its document upload endpoint that allows unauthenticated attackers to fetch arbitrary URLs and read local files or access internal services. This flaw enables attackers to bypass authentication using a hardcoded token and exploit unrestricted URL schemes including file:// URIs.","exploitability":"The vulnerability is easily exploitable with no authentication required, as attackers can simply send a request to the /doc/upload endpoint with the hardcoded testtoken value to bypass authentication and fetch any URL or read any local file.","blast_radius":"The impact could be significant as attackers can access sensitive configuration files, internal network services, and potentially exfiltrate data from systems that are otherwise not directly exposed to the internet.","remediation":"Upgrade to version 2.590 or later to address this vulnerability.","detection":"Monitor for requests to the /doc/upload endpoint with the testtoken parameter and observe for unusual file:// URI access patterns in network logs or file access logs.","tags":["ssrf","file-access","unauthenticated"],"model":"garnet-coder","analyzedAt":"2026-10-13T09:08:21.166Z"}}