CVE-2024-23334
CVE-2024-23334 · aiohttp.web.static(follow_symlinks=True) is vulnerable to directory traversal
This page contains facts from public vulnerability sources. Check the original advisory before updating.
aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. When using aiohttp as a web server and configuring static routes, it is necessary to specify the root path for static files. Additionally, the option 'follow_symlinks' can be used to determine whether to follow symbolic links outside the static root directory. When 'follow_symlinks' is set to True, there is no validation to check if reading a file is within the root directory. This can lead to directory traversal vulnerabilities, resulting in unauthorized access to arbitrary files on the system, even when symlinks are not present. Disabling follow_symlinks and using a reverse proxy are encouraged mitigations. Version 3.9.2 fixes this issue.
CVSS 5.9 · Medium · EPSS 76.9% · Public exploit · Fix available
- Published
- Updated
Affected products and versions
aiohttp
- Versions
- < 3.9.2: Affected
No fix published
python-aiohttp Debian:12
- Versions
- 3.8.4-1
- Affected ranges
- ECOSYSTEM: < 3.8.4-1+deb12u1
Update to 3.8.4-1+deb12u1
python-aiohttp Debian:13
- Affected ranges
- ECOSYSTEM: < 3.9.5-1
Update to 3.9.5-1
python-aiohttp Debian:14
- Affected ranges
- ECOSYSTEM: < 3.9.5-1
Update to 3.9.5-1
aiohttp PyPI
- Versions
- 1.0.5
- 1.1.0
- 1.1.1
- 1.1.2
- 1.1.3
- 1.1.4
- 1.1.5
- 1.1.6
- 1.2.0
- 1.3.0
- 1.3.1
- 1.3.2
- 1.3.3
- 1.3.4
- 1.3.5
- 2.0.0
- 2.0.0rc1
- 2.0.1
- 2.0.2
- 2.0.3
- 2.0.4
- 2.0.5
- 2.0.6
- 2.0.7
- 2.1.0
- 2.2.0
- 2.2.1
- 2.2.2
- 2.2.3
- 2.2.4
- 2.2.5
- 2.3.0
- 2.3.0a1
- 2.3.0a2
- 2.3.0a3
- 2.3.0a4
- 2.3.1
- 2.3.10
- 2.3.1a1
- 2.3.2
- 2.3.2b2
- 2.3.2b3
- 2.3.3
- 2.3.4
- 2.3.5
- 2.3.6
- 2.3.7
- 2.3.8
- 2.3.9
- 3.0.0
- 3.0.0b0
- 3.0.0b1
- 3.0.0b2
- 3.0.0b3
- 3.0.0b4
- 3.0.1
- 3.0.2
- 3.0.3
- 3.0.4
- 3.0.5
- 3.0.6
- 3.0.7
- 3.0.8
- 3.0.9
- 3.1.0
- 3.1.1
- 3.1.2
- 3.1.3
- 3.2.0
- 3.2.1
- 3.3.0
- 3.3.0a0
- 3.3.1
- 3.3.2
- 3.3.2a0
- 3.4.0
- 3.4.0a0
- 3.4.0a3
- 3.4.0b1
- 3.4.0b2
- 3.4.1
- 3.4.2
- 3.4.3
- 3.4.4
- 3.5.0
- 3.5.0a1
- 3.5.0b1
- 3.5.0b2
- 3.5.0b3
- 3.5.1
- 3.5.2
- 3.5.3
- 3.5.4
- 3.6.0
- 3.6.0a0
- 3.6.0a1
- 3.6.0a11
- 3.6.0a12
- 3.6.0a2
- 3.6.0a3
- 3.6.0a4
- 3.6.0a5
- 3.6.0a6
- 3.6.0a7
- 3.6.0a8
- 3.6.0a9
- 3.6.0b0
- 3.6.1
- 3.6.1b3
- 3.6.1b4
- 3.6.2
- 3.6.2a0
- 3.6.2a1
- 3.6.2a2
- 3.6.3
- 3.7.0
- 3.7.0b0
- 3.7.0b1
- 3.7.1
- 3.7.2
- 3.7.3
- 3.7.4
- 3.7.4.post0
- 3.8.0
- 3.8.0a7
- 3.8.0b0
- 3.8.1
- 3.8.2
- 3.8.3
- 3.8.4
- 3.8.5
- 3.8.6
- 3.9.0
- 3.9.0b0
- 3.9.0b1
- 3.9.0rc0
- 3.9.1
- Affected ranges
- ECOSYSTEM: ≥ 1.0.5, < 3.9.2
Update to 3.9.2
aiohttp PyPI
- Versions
- 1.0.5
- 1.1.0
- 1.1.1
- 1.1.2
- 1.1.3
- 1.1.4
- 1.1.5
- 1.1.6
- 1.2.0
- 1.3.0
- 1.3.1
- 1.3.2
- 1.3.3
- 1.3.4
- 1.3.5
- 2.0.0
- 2.0.0rc1
- 2.0.1
- 2.0.2
- 2.0.3
- 2.0.4
- 2.0.5
- 2.0.6
- 2.0.7
- 2.1.0
- 2.2.0
- 2.2.1
- 2.2.2
- 2.2.3
- 2.2.4
- 2.2.5
- 2.3.0
- 2.3.0a1
- 2.3.0a2
- 2.3.0a3
- 2.3.0a4
- 2.3.1
- 2.3.10
- 2.3.1a1
- 2.3.2
- 2.3.2b2
- 2.3.2b3
- 2.3.3
- 2.3.4
- 2.3.5
- 2.3.6
- 2.3.7
- 2.3.8
- 2.3.9
- 3.0.0
- 3.0.0b0
- 3.0.0b1
- 3.0.0b2
- 3.0.0b3
- 3.0.0b4
- 3.0.1
- 3.0.2
- 3.0.3
- 3.0.4
- 3.0.5
- 3.0.6
- 3.0.7
- 3.0.8
- 3.0.9
- 3.1.0
- 3.1.1
- 3.1.2
- 3.1.3
- 3.2.0
- 3.2.1
- 3.3.0
- 3.3.0a0
- 3.3.1
- 3.3.2
- 3.3.2a0
- 3.4.0
- 3.4.0a0
- 3.4.0a3
- 3.4.0b1
- 3.4.0b2
- 3.4.1
- 3.4.2
- 3.4.3
- 3.4.4
- 3.5.0
- 3.5.0a1
- 3.5.0b1
- 3.5.0b2
- 3.5.0b3
- 3.5.1
- 3.5.2
- 3.5.3
- 3.5.4
- 3.6.0
- 3.6.0a0
- 3.6.0a1
- 3.6.0a11
- 3.6.0a12
- 3.6.0a2
- 3.6.0a3
- 3.6.0a4
- 3.6.0a5
- 3.6.0a6
- 3.6.0a7
- 3.6.0a8
- 3.6.0a9
- 3.6.0b0
- 3.6.1
- 3.6.1b3
- 3.6.1b4
- 3.6.2
- 3.6.2a0
- 3.6.2a1
- 3.6.2a2
- 3.6.3
- 3.7.0
- 3.7.0b0
- 3.7.0b1
- 3.7.1
- 3.7.2
- 3.7.3
- 3.7.4
- 3.7.4.post0
- 3.8.0
- 3.8.0a7
- 3.8.0b0
- 3.8.1
- 3.8.2
- 3.8.3
- 3.8.4
- 3.8.5
- 3.8.6
- 3.9.0
- 3.9.0b0
- 3.9.0b1
- 3.9.0rc0
- 3.9.1
- Affected ranges
- GIT: < 1c335944d6a8b1298baf179b7c0b3069f10c514b
- ECOSYSTEM: ≥ 1.0.5, < 3.9.2
Update to 3.9.2
python-aiohttp Ubuntu:Pro:16.04:LTS
- Versions
- 0.17.2-1
- 0.17.4-1
- 0.17.4-1build1
- 0.20.2-1
- 0.20.2-1ubuntu0.1~esm1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
python-aiohttp Ubuntu:Pro:18.04:LTS
- Versions
- 2.2.3-1build1
- 2.2.3-2
- 2.3.6-1
- 3.0.1-1
- 3.0.1-1ubuntu0.1~esm1
- Affected ranges
- ECOSYSTEM: < 3.0.1-1ubuntu0.1~esm4
Update to 3.0.1-1ubuntu0.1~esm4
python-aiohttp Ubuntu:Pro:20.04:LTS
- Versions
- 3.5.4-1
- 3.5.4-1build1
- 3.6.1-1
- 3.6.2-1
- 3.6.2-1build1
- 3.6.2-1ubuntu0.1~esm1
- 3.6.2-1ubuntu1
- 3.6.2-1ubuntu1+esm1
- Affected ranges
- ECOSYSTEM: < 3.6.2-1ubuntu1+esm3
Update to 3.6.2-1ubuntu1+esm3
python-aiohttp Ubuntu:22.04:LTS
- Versions
- 3.7.4-1
- 3.7.4-1build2
- 3.8.1-3
- 3.8.1-4
- 3.8.1-4build1
- Affected ranges
- ECOSYSTEM: < 3.8.1-4ubuntu0.2
Update to 3.8.1-4ubuntu0.2
python-aiohttp Ubuntu:24.04:LTS
- Versions
- 3.8.4-1
- 3.9.1-1
- 3.9.1-1build1
- Affected ranges
- ECOSYSTEM: < 3.9.1-1ubuntu0.1
Update to 3.9.1-1ubuntu0.1
python-aiohttp Ubuntu:25.10
- Versions
- 3.10.11-1build1
- 3.11.16-1
- 3.11.16-1ubuntu0.1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
python-aiohttp Ubuntu:26.10
- Versions
- 3.13.3-3ubuntu1
- 3.14.1-4
- 3.14.1-5
- 3.14.3-1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
python-aiohttp Ubuntu:Pro:26.04:LTS
- Versions
- 3.11.16-1
- 3.13.1-1
- 3.13.3-3
- 3.13.3-3ubuntu1
- 3.13.3-3ubuntu1+esm1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
Original sources
- https://github.com/aio-libs/aiohttp/security/advisories/GHSA-5h86-8mv2-jq9f
- https://github.com/aio-libs/aiohttp/pull/8079
- https://github.com/aio-libs/aiohttp/commit/1c335944d6a8b1298baf179b7c0b3069f10c514b
- https://lists.fedoraproject.org/archives/list/[email protected]/message/XXWVZIVAYWEBHNRIILZVB3R3SDQNNAA7/
- https://lists.fedoraproject.org/archives/list/[email protected]/message/ICUOCFGTB25WUT336BZ4UNYLSZOUVKBD/
- https://lists.debian.org/debian-lts-announce/2025/02/msg00002.html
- https://www.exploit-db.com/exploits/52474
- https://nvd.nist.gov/vuln/detail/CVE-2024-23334