CVE-2024-23334: medium-severity vulnerability in aio-libs aiohttp
aiohttp.web.static(follow_symlinks=True) is vulnerable to directory traversal
Published · Updated
94Vexday Risk Score
Patch now. It exploitation observed by VulnCheck and has a working public exploit.
ssvc Actcvss 5.9epss 77%
from disclosure to weapon30 days
Published on NVDJan 29
1st PoC+30d
VulnCheck+46d
exploitation probability
77%top 1% of all CVEs
observed exploitation
yesVulnCheck
26 public exploit(s)
What the vendors declare (VEX)
Official vendor statements in CSAF/VEX format: whether their product is affected, already fixed, or ruled out — and why. These are the vendor's assertions, not Vexday's judgment.
Red HatVEX document ↗
Affected
1 product
Red Hat Ansible Automation Platform 1.2
workaround: If using follow_symlinks=True outside of a restricted local development environment, disable the option immediately. This option is NOT needed to follow symlinks that point to a location within the static root directory…
Fixed
5 products (54 components)
Red Hat Ansible Automation Platform 2.4 for RHEL 8 · Red Hat Ansible Automation Platform 2.4 for RHEL 9 · Red Hat Satellite 6.14 for RHEL 8 · Red Hat Satellite 6.15 for RHEL 8 · RHUI 4 for RHEL 8
Not affected
6 products (2,257 components) — because the vulnerable code is not present in the product
Red Hat Satellite 6.15 for RHEL 8 · RHUI 4 for RHEL 8 · Red Hat Satellite 6.14 for RHEL 8 · Red Hat Ansible Automation Platform 2.4 for RHEL 8 · Red Hat Ansible Automation Platform 2.4 for RHEL 9 · and others 1
aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. When using aiohttp as a web server and configuring static routes, it is necessary to specify the root path for static files. Additionally, the option 'follow_symlinks' can be used to determine whether to follow symbolic links outside the static root directory. When 'follow_symlinks' is set to True, there is no validation to check if reading a file is within the root directory. This can lead to directory traversal vulnerabilities, resulting in unauthorized access to arbitrary files on the system, even when symlinks are not present. Disabling follow_symlinks and using a reverse proxy are encouraged mitigations. Version 3.9.2 fixes this issue.
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Affected products
aio-libs · aiohttppublic PoCs found — 26
cve_referencewww.exploit-db.com/exploits/52474unverifiedgithubgithub.com/jhonnybonny/CVE-2024-23334★ 27githubgithub.com/z3rObyte/CVE-2024-23334-PoC★ 20githubgithub.com/ox1111/CVE-2024-23334★ 6githubgithub.com/wizarddos/CVE-2024-23334★ 5githubgithub.com/s4botai/CVE-2024-23334-PoC★ 4githubgithub.com/sxyrxyy/aiohttp-exploit-CVE-2024-23334-certstream★ 4githubgithub.com/TheRedP4nther/LFI-aiohttp-CVE-2024-23334-PoC★ 2githubgithub.com/0xR00/CVE-2024-23334★ 1githubgithub.com/Betan423/CVE-2024-23334-PoC★ 1githubgithub.com/Arc4he/CVE-2024-23334-PoC★ 1githubgithub.com/binaryninja/CVE-2024-23334★ 0githubgithub.com/brian-edgar-re/poc-cve-2024-23334★ 0githubgithub.com/BestDevOfc/CVE-2024-23334-PoC★ 0githubgithub.com/Sn0wBaall/CVE-2024-23334-PoC★ 0vulncheckvulncheck.com/xdb/a3696a1d17bfunverifiedvulncheckvulncheck.com/xdb/9dc7cef76d0dunverifiedvulncheckvulncheck.com/xdb/e5449a962b26unverifiedvulncheckvulncheck.com/xdb/77981ccbbfd1unverifiedvulncheckvulncheck.com/xdb/3b0121cf65f7unverifiedvulncheckvulncheck.com/xdb/50842d6b7234unverifiedvulncheckvulncheck.com/xdb/f2c31f560411unverifiedvulncheckvulncheck.com/xdb/5230c11bc1bcunverifiedvulncheckvulncheck.com/xdb/231b48941355unverifiedvulncheckvulncheck.com/xdb/f1d001911304unverifiedvulncheckvulncheck.com/xdb/0847d825e445unverified⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — aio-libs aiohttp
In the same product, most dangerous first.
CVE-2021-21330LOWOpen redirect vulnerability in aiohttpEPSS 1.9%CVE-2023-37276MEDIUMaiohttp vulnerable to HTTP request smugglingEPSS 1.3%CVE-2024-30251HIGHDenial of service when trying to parse malformed POST requests in aiohttpEPSS 1.1%CVE-2024-23829MEDIUMaiohttp's HTTP parser (the python one, not llhttp) still overly lenient about separatorsEPSS 1.0%CVE-2023-49082MEDIUMaiohttp's ClientSession is vulnerable to CRLF injection via methodEPSS 0.9%CVE-2023-49081HIGHaiohttp's ClientSession is vulnerable to CRLF injection via versionEPSS 0.9%
References
https://github.com/aio-libs/aiohttp/commit/1c335944d6a8b1298baf179b7c0b3069f10c514bhttps://github.com/aio-libs/aiohttp/pull/8079https://github.com/aio-libs/aiohttp/security/advisories/GHSA-5h86-8mv2-jq9fhttps://lists.debian.org/debian-lts-announce/2025/02/msg00002.htmlhttps://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ICUOCFGTB25WUT336BZ4UNYLSZOUVKBD/https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XXWVZIVAYWEBHNRIILZVB3R3SDQNNAA7/https://www.exploit-db.com/exploits/52474