CVE-2024-23334mediumexploração observadaCWE-22

CVE-2024-23334: falha de média gravidade em aio-libs aiohttp

aiohttp.web.static(follow_symlinks=True) is vulnerable to directory traversal

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar aiohttp+ Monitorar aiohttp

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

94Vexday Risk Score

Corrija agora. Ela exploração observada pelo VulnCheck e tem exploit funcional público.

ssvc Actcvss 5.9epss 77%
da publicação à arma30 dias
Publicada no NVD29 de jan.
1ª PoC+30d
VulnCheck+46d
O que os fabricantes declaram (VEX)

Declarações oficiais dos fabricantes em formato CSAF/VEX: se o produto deles está afetado, já corrigido ou descartado — e por quê. É afirmação do fabricante, não juízo do Vexday.

Red Hatdocumento VEX ↗
Afetado
1 produto
Red Hat Ansible Automation Platform 1.2
workaround: If using follow_symlinks=True outside of a restricted local development environment, disable the option immediately. This option is NOT needed to follow symlinks that point to a location within the static root directory…
Corrigido
5 produtos (54 componentes)
Red Hat Ansible Automation Platform 2.4 for RHEL 8 · Red Hat Ansible Automation Platform 2.4 for RHEL 9 · Red Hat Satellite 6.14 for RHEL 8 · Red Hat Satellite 6.15 for RHEL 8 · RHUI 4 for RHEL 8
correção ↗
Não afetado
6 produtos (2.257 componentes) — porque o código vulnerável não está presente no produto
Red Hat Satellite 6.15 for RHEL 8 · RHUI 4 for RHEL 8 · Red Hat Satellite 6.14 for RHEL 8 · Red Hat Ansible Automation Platform 2.4 for RHEL 8 · Red Hat Ansible Automation Platform 2.4 for RHEL 9 · e outros 1
aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. When using aiohttp as a web server and configuring static routes, it is necessary to specify the root path for static files. Additionally, the option 'follow_symlinks' can be used to determine whether to follow symbolic links outside the static root directory. When 'follow_symlinks' is set to True, there is no validation to check if reading a file is within the root directory. This can lead to directory traversal vulnerabilities, resulting in unauthorized access to arbitrary files on the system, even when symlinks are not present. Disabling follow_symlinks and using a reverse proxy are encouraged mitigations. Version 3.9.2 fixes this issue.
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Produtos afetados
aio-libs · aiohttp
PoCs públicas encontradas — 29
cve_referencewww.exploit-db.com/exploits/52474não verificadogithubgithub.com/jhonnybonny/CVE-2024-23334★ 27githubgithub.com/z3rObyte/CVE-2024-23334-PoC★ 20githubgithub.com/ox1111/CVE-2024-23334★ 6githubgithub.com/wizarddos/CVE-2024-23334★ 5githubgithub.com/s4botai/CVE-2024-23334-PoC★ 4githubgithub.com/sxyrxyy/aiohttp-exploit-CVE-2024-23334-certstream★ 4githubgithub.com/TheRedP4nther/LFI-aiohttp-CVE-2024-23334-PoC★ 2githubgithub.com/frogb1t/CVE-2024-23334★ 1githubgithub.com/0xR00/CVE-2024-23334★ 1githubgithub.com/Betan423/CVE-2024-23334-PoC★ 1githubgithub.com/Arc4he/CVE-2024-23334-PoC★ 1githubgithub.com/JohnnyWang108/hdu-is-lab1-secure-api★ 0githubgithub.com/binaryninja/CVE-2024-23334★ 0githubgithub.com/BestDevOfc/CVE-2024-23334-PoC★ 0githubgithub.com/brian-edgar-re/poc-cve-2024-23334★ 0githubgithub.com/begzodxasanboev/Driftnet★ 0githubgithub.com/Sn0wBaall/CVE-2024-23334-PoC★ 0vulncheckvulncheck.com/xdb/9dc7cef76d0dnão verificadovulncheckvulncheck.com/xdb/e5449a962b26não verificadovulncheckvulncheck.com/xdb/77981ccbbfd1não verificadovulncheckvulncheck.com/xdb/3b0121cf65f7não verificadovulncheckvulncheck.com/xdb/50842d6b7234não verificadovulncheckvulncheck.com/xdb/f2c31f560411não verificadovulncheckvulncheck.com/xdb/5230c11bc1bcnão verificadovulncheckvulncheck.com/xdb/231b48941355não verificadovulncheckvulncheck.com/xdb/f1d001911304não verificadovulncheckvulncheck.com/xdb/0847d825e445não verificadovulncheckvulncheck.com/xdb/a3696a1d17bfnão verificado
⚠ Recursos públicos, para você avaliar a exposição de sistemas que controla ou está autorizado a testar. Teste apenas com autorização.
CVEs relacionadas — aio-libs aiohttp

No mesmo produto, das mais perigosas para as menos.

CVE-2021-21330LOWOpen redirect vulnerability in aiohttpEPSS 1.9%CVE-2023-37276MEDIUMaiohttp vulnerable to HTTP request smugglingEPSS 1.3%CVE-2024-30251HIGHDenial of service when trying to parse malformed POST requests in aiohttpEPSS 1.1%CVE-2024-23829MEDIUMaiohttp's HTTP parser (the python one, not llhttp) still overly lenient about separatorsEPSS 1.0%CVE-2023-49082MEDIUMaiohttp's ClientSession is vulnerable to CRLF injection via methodEPSS 0.9%CVE-2023-49081HIGHaiohttp's ClientSession is vulnerable to CRLF injection via versionEPSS 0.9%