aiohttp: Path traversal vulnerability (CVE-2024-23334)

CVE-2024-23334 is a path traversal vulnerability affecting aiohttp versions earlier than 3.9.2. An attacker can exploit this vulnerability by uploading a compressed archive containing a symbolic link that points to sensitive files, such as /etc/shadow. This allows the attacker to read arbitrary files on the system outside of the intended directory. Publicly available exploit scripts are currently circulating, which automate the discovery of vulnerable hosts and attempt exploitation.

Impact

Successful exploitation allows for unauthorized read access to arbitrary files on the filesystem, potentially exposing sensitive system information or credentials depending on the application context and permissions of the service running aiohttp.

Recommendation

• Upgrade aiohttp to version 3.9.2 or later to mitigate the vulnerability.
• Implement strict validation on uploaded file contents and reject archives containing symbolic links.
• Identify all internet-facing services utilizing the aiohttp library and prioritize patching for those instances.
• Monitor web application logs for file upload requests containing path traversal sequences or attempts to traverse outside of designated upload directories.