CVE-2024-23334 is a directory traversal vulnerability in aiohttp, an asynchronous HTTP client/server framework for Python, affecting versions prior to 3.9.2. When aiohttp is configured to serve static files with 'follow_symlinks' set to True, it fails to validate file paths, allowing attackers to access arbitrary files outside the intended root directory. This vulnerability carries a CVSS score of 7.5 (HIGH) due to its network-based attack vector, low attack complexity, and high impact on confidentiality. Exploit code, including Nuclei templates and an ExploitDB PoC, is publicly available, and the vulnerability has garnered significant community discussion and media coverage, with reports of active exploitation by threat actors.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
>= 1.0.5, < 3.9.2CPE matchmatch criteria | cpe:2.3:a:aiohttp:aiohttp:*:*:*:*:*:*:*:* | ||
39CPE matchmatch criteria | cpe:2.3:o:fedoraproject:fedora:39:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.1 Mastodon, and 0.4 GitHub mentions.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
aiohttp: follow_symlinks directory traversal vulnerability
Jan 30, 2024aiohttp is vulnerable to directory traversal
Jan 29, 2024aiohttp.web.static(follow_symlinks=True) is vulnerable to directory traversal
Jan 9, 2024