CVE-2024-23334 PoC — aiohttp.web.static(follow_symlinks=True) is vulnerable to directory traversal

Source

https://github.com/jhonnybonny/CVE-2024-23334

Associated Vulnerability

Title:aiohttp.web.static(follow_symlinks=True) is vulnerable to directory traversal (CVE-2024-23334)
Description:aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. When using aiohttp as a web server and configuring static routes, it is necessary to specify the root path for static files. Additionally, the option 'follow_symlinks' can be used to determine whether to follow symbolic links outside the static root directory. When 'follow_symlinks' is set to True, there is no validation to check if reading a file is within the root directory. This can lead to directory traversal vulnerabilities, resulting in unauthorized access to arbitrary files on the system, even when symlinks are not present. Disabling follow_symlinks and using a reverse proxy are encouraged mitigations. Version 3.9.2 fixes this issue.

Description

aiohttp LFI (CVE-2024-23334)

Readme

# CVE-2024-23334 PoC

## Description
This repository contains a Proof of Concept (PoC) for CVE-2024-23334, demonstrating how malicious actors can exploit vulnerabilities in aiohttp using LFI .

> [!CAUTION]
> Disclaimer: IMPORTANT: This PoC is for educational purposes only. Unauthorized access to computer systems and networks is illegal !!!

## Installation
1. Clone the repository:
   ```bash
   git clone https://github.com/jhonnybonny/CVE-2024-23334
   cd CVE-2024-23334
   python3 -m venv .env
   chmod +x ./.env/bin/activate
   source ./.env/bin/activate
   pip3 install -r requirements.txt
   ```
2.Start the server:
   ```bash
   python3 server.py
   ```
![Screenshot 2024-03-19 at 18 47 09](https://github.com/jhonnybonny/CVE-2024-23334/assets/87495218/2bb31fe4-2493-40d2-95b3-59744014fd1b)

3.Scanner:
   ```bash
   nuclei -t aiohttp.yaml -u http://localhost:8081
   ```
or
   ```bash
   nuclei -t aiohttp.yaml -l aiohttp.csv
   ```
![Screenshot 2024-03-19 at 18 41 07](https://github.com/jhonnybonny/CVE-2024-23334/assets/87495218/81d2ced7-b69f-4e53-9bf4-a200c61434d4)

3.Exploit:
   ```bash
   python3 exploit.py -s http://localhost:8081
   ```
![Screenshot 2024-03-19 at 18 45 47](https://github.com/jhonnybonny/CVE-2024-23334/assets/87495218/7d17ef82-2a5a-4198-9d49-5b569c38deaa)

File Snapshot


 [4.0K]  /data/pocs/f45a2e79d9dfbcde7d5273daa98f1ecb30cf1806
├── [ 819]  aiohttp.yaml
├── [1022]  exploit.py
├── [1.3K]  README.md
├── [  15]  requirements.txt
└── [ 637]  server.py

0 directories, 5 files

Shenlong Bot has cached this for you

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →

Goal Reached Thanks to every supporter — we hit 100%!