iDocView: Server-side request forgery via hardcoded default token
Summary
iDocView contains a server-side request forgery (SSRF) flaw in its /doc/upload endpoint. A remote, unauthenticated attacker can bypass authentication with the hardcoded default token value 'testtoken' and make the server fetch arbitrary URLs, including file:// URIs. This allows reading local operating system and application configuration files and reaching internal network hosts and services that are otherwise not accessible.
Affected
- iDocView, all versions according to the CNA record (version range not specified)
- A third-party claim lists v3.0.1 and earlier as affected; not verified with the vendor or VulnCheck
Fixed in
Unknown. No vendor advisory or confirmed fixed version was found.
Workaround
- Restrict access to the service (VPN or allowlist only); do not expose it directly to the internet
- Whitelist URL schemes and allow only http and https; block file://, ftp:// and gopher://
- Restrict outbound traffic of the application server to known internal services with firewall rules
- Change or disable the default token if the product supports it; confirm with the vendor first
Exploitation
- Conflicting information: some sources report exploitation (including a CISA KEV-style entry and a Shadowserver observation dated 2024-03-26), while others do not mark it as known exploited
- Public proof-of-concept write-ups and a Nuclei detection template exist
- VulDB states no exploit is available
- CISA SSVC: exploitation 'poc', automatable: yes, technical impact: partial
Our recommendation
- Identify all iDocView instances in the client inventory and check whether any are internet-facing
- Remove direct internet exposure immediately and restrict access to trusted networks
- Apply the URL scheme whitelist and outbound firewall restrictions until a vendor fix is confirmed
- Contact the vendor for an advisory and a fixed version, and patch as soon as one is available
- Monitor web and server logs for requests to /doc/upload with the token parameter and for unusual outbound connections from the server
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- VulnCheck advisory www.vulncheck.com
- Nuclei template idocview-lfi.yaml github.com
- OpenCVE CVE-2023-54402 app.opencve.io
- VulDB CVE-2023-54402 vuldb.com
- VulDB 412386 vuldb.com
- Redpacket Security alert www.redpacketsecurity.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 06:32.
Original description (NVD)
iDocView contains a server-side request forgery vulnerability in its /doc/upload endpoint that allows remote unauthenticated attackers to fetch arbitrary URLs by supplying a hardcoded default token value (testtoken) to bypass authentication. Attackers can exploit the unrestricted URL scheme handling, including file:// URIs, to read arbitrary local files such as operating-system and application configuration files, and to reach internal network hosts and services not otherwise accessible. Exploitation evidence was first observed by the Shadowserver Foundation on 2024-03-26.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.