CVE-2024-23334: aiohttp.web.static(follow_symlinks=True) is vulnerable to directory traversal

Vulnerability summary

CVE-2024-23334 is a high (CVSS 7.5) vulnerability in aio-libs aiohttp. EPSS estimates a 76.88% chance of exploitation in the next 30 days, higher than 99.5% of scored vulnerabilities. 2 public exploits are recorded.

Timeline

1. 29-01-2024
   PublishedVulnerability first disclosed.
2. 04-02-2026
   Last modifiedVulnerability information updated.

Description

aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. When using aiohttp as a web server and configuring static routes, it is necessary to specify the root path for static files. Additionally, the option 'follow_symlinks' can be used to determine whether to follow symbolic links outside the static root directory. When 'follow_symlinks' is set to True, there is no validation to check if reading a file is within the root directory. This can lead to directory traversal vulnerabilities, resulting in unauthorized access to arbitrary files on the system, even when symlinks are not present. Disabling follow_symlinks and using a reverse proxy are encouraged mitigations. Version 3.9.2 fixes this issue.

• CWE-22Improper Limitation of a Pathname to a Restricted DirectoryThe product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.