CVE-2024-42367: aio-libs aiohttp UNIX Symbolic Link (Symlink) Following

Vulnerability summary

CVE-2024-42367 is a medium (CVSS 4.8) UNIX Symbolic Link (Symlink) Following vulnerability in aio-libs aiohttp. EPSS estimates a 0.65% chance of exploitation in the next 30 days, higher than 50.2% of scored vulnerabilities.

Timeline

1. 09-08-2024
   PublishedVulnerability first disclosed.
2. 09-06-2025
   Last modifiedVulnerability information updated.

Description

aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. In versions on the 3.10 branch prior to version 3.10.2, static routes which contain files with compressed variants (`.gz` or `.br` extension) are vulnerable to path traversal outside the root directory if those variants are symbolic links. The server protects static routes from path traversal outside the root directory when `follow_symlinks=False` (default). It does this by resolving the requested URL to an absolute path and then checking that path relative to the root. However, these checks are not performed when looking for compressed variants in the `FileResponse` class, and symbolic links are then automatically followed when performing the `Path.stat()` and `Path.open()` to send the file. Version 3.10.2 contains a patch for the issue.

• CWE-61UNIX Symbolic Link (Symlink) FollowingThe product, when opening a file or directory, does not sufficiently account for when the file is a symbolic link that resolves to a target outside of the intended control sphere. This could allow an attacker to cause the product to operate on unauthorized files.