CVE-2024-23334
published 2024-01-29CVE-2024-23334: aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. When using aiohttp as a web server and configuring static routes, it is…
PriorityP190high7.5CVSS 3.1
AVNACLPRNUINSUCHINAN
ITWEXPLOITVulnCheck KEVRansomwareInitial access
Exploited in the wild
EPSS
76.88%
99.5th percentile
aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. When using aiohttp as a web server and configuring static routes, it is necessary to specify the root path for static files. Additionally, the option 'follow_symlinks' can be used to determine whether to follow symbolic links outside the static root directory. When 'follow_symlinks' is set to True, there is no validation to check if reading a file is within the root directory. This can lead to directory traversal vulnerabilities, resulting in unauthorized access to arbitrary files on the system, even when symlinks are not present. Disabling follow_symlinks and using a reverse proxy are encouraged mitigations. Version 3.9.2 fixes this issue.
Affected
5 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| aio-libs | aiohttp | < 3.9.2 | 3.9.2 |
| aiohttp | aiohttp | >= 1.0.5 < 3.9.2 | 3.9.2 |
| aiohttp | aiohttp | >= 1.0.5 < 3.9.2 | 3.9.2 |
| debian | python-aiohttp | < python-aiohttp 3.8.4-1+deb12u1 (bookworm) | python-aiohttp 3.8.4-1+deb12u1 (bookworm) |
| fedoraproject | fedora | — | — |
Detection & IOCsextracted from sources · hover to see the quote
url/static/../../../../etc/passwd
yara
Nuclei template: GET /static/../../../../etc/passwd matching body regex root:.*:0:0: and header words aiohttp / application/octet-stream, status 200
- →Responses from a vulnerable aiohttp server serving traversed files will include the 'aiohttp' header and 'application/octet-stream' content-type. Correlate these response headers with path-traversal request patterns.
- →Exploitation requires 'follow_symlinks=True' to be set on static routes. Audit aiohttp server configurations for this non-default setting as a precondition indicator. ↗
- →Active exploitation scanning for CVE-2024-23334 was observed starting February 29, 2024, with increased activity into March 2024. Prioritize detection of traversal attempts against /static/ endpoints during this window. ↗
- →The PoC exploit uses a default traversal depth of 8 (eight '../' segments). Detection rules should match at least 4–8 consecutive '../' sequences in URL paths targeting /static/. ↗
- ·The vulnerability is only exploitable when 'follow_symlinks=True' is explicitly set on aiohttp static routes — this is a non-default configuration. Servers without this setting are not affected. ↗
- ·The 'follow_symlinks' option is NOT needed to follow symlinks pointing within the static root directory; it is only intended to allow a symlink to break out of the static directory. Disabling it does not break normal in-root symlink resolution. ↗
- ·Using a reverse proxy (e.g., nginx) to serve static files instead of aiohttp is a recommended mitigation and is why the number of affected production users is expected to be low. ↗
CVSS provenance
nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
osv7.5HIGH
vulncheck5.9MEDIUM
vendor_debian5.9MEDIUM
vendor_redhat5.9MEDIUM
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
aiohttp is vulnerable to directory traversal
ghsa·2024-01-29
CVE-2024-23334 [HIGH] CWE-22 aiohttp is vulnerable to directory traversal
aiohttp is vulnerable to directory traversal
### Summary
Improperly configuring static resource resolution in aiohttp when used as a web server can result in the unauthorized reading of arbitrary files on the system.
### Details
When using aiohttp as a web server and configuring static routes, it is necessary to specify the root path for static files. Additionally, the option 'follow_symlinks' can be used to determine whether to follow symbolic links outside the static root directory. When 'follow_symlinks' is set to True, there is no validation to check if a given file path is within the root directory.This can lead to directory traversal vulnerabilities, resulting in unauthorized access to arbitrary files on the system, even when symlinks are not present.
i.e. An application is only v
OSV
aiohttp is vulnerable to directory traversal
osv·2024-01-29
CVE-2024-23334 [HIGH] aiohttp is vulnerable to directory traversal
aiohttp is vulnerable to directory traversal
### Summary
Improperly configuring static resource resolution in aiohttp when used as a web server can result in the unauthorized reading of arbitrary files on the system.
### Details
When using aiohttp as a web server and configuring static routes, it is necessary to specify the root path for static files. Additionally, the option 'follow_symlinks' can be used to determine whether to follow symbolic links outside the static root directory. When 'follow_symlinks' is set to True, there is no validation to check if a given file path is within the root directory.This can lead to directory traversal vulnerabilities, resulting in unauthorized access to arbitrary files on the system, even when symlinks are not present.
i.e. An application is only v
OSV
CVE-2024-23334: aiohttp is an asynchronous HTTP client/server framework for asyncio and Python
osv·2024-01-29·CVSS 7.5
CVE-2024-23334 [HIGH] CVE-2024-23334: aiohttp is an asynchronous HTTP client/server framework for asyncio and Python
aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. When using aiohttp as a web server and configuring static routes, it is necessary to specify the root path for static files. Additionally, the option 'follow_symlinks' can be used to determine whether to follow symbolic links outside the static root directory. When 'follow_symlinks' is set to True, there is no validation to check if reading a file is within the root directory. This can lead to directory traversal vulnerabilities, resulting in unauthorized access to arbitrary files on the system, even when symlinks are not present. Disabling follow_symlinks and using a reverse proxy are encouraged mitigations. Version 3.9.2 fixes this issue.
VulnCheck
aiohttp aiohttp Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
vulncheck·2024·CVSS 5.9
CVE-2024-23334 [MEDIUM] aiohttp aiohttp Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
aiohttp aiohttp Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. When using aiohttp as a web server and configuring static routes, it is necessary to specify the root path for static files. Additionally, the option 'follow_symlinks' can be used to determine whether to follow symbolic links outside the static root directory. When 'follow_symlinks' is set to True, there is no validation to check if reading a file is within the root directory. This can lead to directory traversal vulnerabilities, resulting in unauthorized access to arbitrary files on the system, even when symlinks are not present. Disabling follow_symlinks and using a reverse proxy are encouraged mitigations. Version
Ubuntu
AIOHTTP vulnerability
vendor_ubuntu·2024-09-05
CVE-2024-23334 AIOHTTP vulnerability
Title: AIOHTTP vulnerability
Summary: python-aiohttp would allow unintended access to files over the network.
It was discovered that AIOHTTP did not properly restrict file access when
the 'follow_symlinks' option was set to True. A remote attacker could
possibly use this issue to access unauthorized files on the system.
Instructions: In general, a standard system update will make all the necessary changes.
Red Hat
aiohttp: follow_symlinks directory traversal vulnerability
vendor_redhat·2024-01-30·CVSS 5.9
CVE-2024-23334 [MEDIUM] CWE-22 aiohttp: follow_symlinks directory traversal vulnerability
aiohttp: follow_symlinks directory traversal vulnerability
aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. When using aiohttp as a web server and configuring static routes, it is necessary to specify the root path for static files. Additionally, the option 'follow_symlinks' can be used to determine whether to follow symbolic links outside the static root directory. When 'follow_symlinks' is set to True, there is no validation to check if reading a file is within the root directory. This can lead to directory traversal vulnerabilities, resulting in unauthorized access to arbitrary files on the system, even when symlinks are not present. Disabling follow_symlinks and using a reverse proxy are encouraged mitigations. Version 3.9.2 fixes this issue.
A flaw was
Debian
CVE-2024-23334: python-aiohttp - aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. ...
vendor_debian·2024·CVSS 5.9
CVE-2024-23334 [MEDIUM] CVE-2024-23334: python-aiohttp - aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. ...
aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. When using aiohttp as a web server and configuring static routes, it is necessary to specify the root path for static files. Additionally, the option 'follow_symlinks' can be used to determine whether to follow symbolic links outside the static root directory. When 'follow_symlinks' is set to True, there is no validation to check if reading a file is within the root directory. This can lead to directory traversal vulnerabilities, resulting in unauthorized access to arbitrary files on the system, even when symlinks are not present. Disabling follow_symlinks and using a reverse proxy are encouraged mitigations. Version 3.9.2 fixes this issue.
Scope: local
bookworm: resolved (fixed in 3.8.4-1+deb12u1)
bullseye: re
Suricata
ET WEB_SPECIFIC_APPS Vulnerable aiohttp Server Version Response (CVE-2024-23334)
suricata·2024-09-24·CVSS 5.9
CVE-2024-23334 [MEDIUM] ET WEB_SPECIFIC_APPS Vulnerable aiohttp Server Version Response (CVE-2024-23334)
ET WEB_SPECIFIC_APPS Vulnerable aiohttp Server Version Response (CVE-2024-23334)
Rule: alert http $HOME_NET any -> any any (msg:"ET WEB_SPECIFIC_APPS Vulnerable aiohttp Server Version Response (CVE-2024-23334)"; flow:established,to_client; http.server; content:"aiohttp|2f|"; fast_pattern; pcre:"/^(?:1\x2e(?:0\x2e[6-9]|[1-9]\x2e\d)|2\x2e\d\x2e(?:0(?:rc1)?|[1-9]){1,2}|3\x2e[0-6]\x2e[0-1])\x0d\x0a/R"; reference:cve,2024-23334; classtype:web-application-activity; sid:2056093; rev:2; metadata:attack_target Server, tls_state plaintext, created_at 2024_09_24, cve CVE_2024_23334, deployment Perimeter, deployment Internal, performance_impact Low, confidence High, signature_severity Major, tag Exploit, updated_at 2024_09_25, reviewed_at 2025_08_26, mitre_tactic_id TA0001, mitre_tactic_name Initial_
Exploit-DB
aiohttp 3.9.1 - directory traversal PoC
exploitdb·2026-02-04·CVSS 5.9
CVE-2024-23334 [MEDIUM] aiohttp 3.9.1 - directory traversal PoC
aiohttp 3.9.1 - directory traversal PoC
---
# Exploit Title: Python aiohttp directory traversal PoC (CVE-2024-23334)
# Google Dork: N/A
# Date: 2025-10-06
# Exploit Author: Beatriz Fresno Naumova
# Vendor Homepage: https://www.aiohttp.org / https://www.python.org
# Software Link: https://github.com/aio-libs/aiohttp (vulnerable tag: 3.9.1)
# Version: aiohttp 3.9.1 (vulnerable)
# Tested on: Linux (host for Vulhub / Docker) and inside container VM: aiohttp 3.9.1
# CVE: CVE-2024-23334
# Description:
# Proof-of-concept to verify directory-traversal behavior when aiohttp is configured
# to serve static files with follow_symlinks=True (affects aiohttp /bin/sh -c "echo 'POC-AIOHTTP-VULN-TEST' > /tmp/poc-aiohttp-test.txt && chmod 644 /tmp/poc-aiohttp-test.txt"
# 3. Verify:
# docker exec -it /bin
Nuclei
aiohttp - Directory Traversal
nuclei·CVSS 7.5
CVE-2024-23334 [HIGH] aiohttp - Directory Traversal
aiohttp - Directory Traversal
aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. When using aiohttp as a web server and configuring static routes, it is necessary to specify the root path for static files. Additionally, the option 'follow_symlinks' can be used to determine whether to follow symbolic links outside the static root directory. When 'follow_symlinks' is set to True, there is no validation to check if reading a file is within the root directory. This can lead to directory traversal vulnerabilities, resulting in unauthorized access to arbitrary files on the system, even when symlinks are not present. Disabling follow_symlinks and using a reverse proxy are encouraged mitigations. Version 3.9.2 fixes this issue.
Template:
id: CVE-2024-23334
info:
na
Bugzilla
CVE-2024-23334 aiohttp: follow_symlinks directory traversal vulnerability
bugzilla·2024-01-30·CVSS 7.5
CVE-2024-23334 [HIGH] CVE-2024-23334 aiohttp: follow_symlinks directory traversal vulnerability
CVE-2024-23334 aiohttp: follow_symlinks directory traversal vulnerability
aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. When using aiohttp as a web server and configuring static routes, it is necessary to specify the root path for static files. Additionally, the option 'follow_symlinks' can be used to determine whether to follow symbolic links outside the static root directory. When 'follow_symlinks' is set to True, there is no validation to check if reading a file is within the root directory. This can lead to directory traversal vulnerabilities, resulting in unauthorized access to arbitrary files on the system, even when symlinks are not present. Disabling follow_symlinks and using a reverse proxy are encouraged mitigations. Version 3.9.2 fixes this iss
Bleepingcomputer
Hackers exploit Aiohttp bug to find vulnerable networks
blogs_bleepingcomputer·2024-03-16·CVSS 5.9
CVE-2024-23334 [MEDIUM] Hackers exploit Aiohttp bug to find vulnerable networks
## Hackers exploit Aiohttp bug to find vulnerable networks
## Bill Toulas
The ransomware actor 'ShadowSyndicate' was observed scanning for servers vulnerable to CVE-2024-23334, a directory traversal vulnerability in the aiohttp Python library.
Aiohttp is an open-source library built on top of Python's asynchronous I/O framework, Asyncio, to handle large amounts of concurrent HTTP requests without traditional thread-based networking.
It is used by tech firms, web developers, backend engineers, and data scientists looking to build high-performance web applications and services that aggregate data from multiple external APIs.
On January 28, 2024, aiohttp released version 3.9.2, addressing CVE-2024-23334, a high-severity path traversal flaw impacting all versions of aiohttp from 3.9.1 and
CTF
Chemistry / README
ctf_writeups·CVSS 5.9
CVE-2024-23346 [MEDIUM] Chemistry / README
# Chemistry - HackTheBox - Writeup
Linux, 20 Base Points, Easy
## Machine
## TL;DR
***User***: Exploited `CVE-2024-23346` to achieve RCE by uploading a malicious `CIF` file, resulting in a reverse shell as the `app` user. Discovered the password for the `rosa` user in the `database.md` file.
***Root***: Identified a local port `8080` hosting a web application using `aiohttp`. Exploited `CVE-2024-23334` to achieve `LFI`, allowing retrieval of the `root` private SSH key.
## Chemistry Solution
### User
Let's begin by using `nmap` to scan the target machine:
```console
┌─[evyatar9@parrot]─[/hackthebox/Chemistry]
└──╼ $ nmap -sV -sC -oA nmap/Chemistry 10.10.11.38
Starting Nmap 7.93 ( https://nmap.org ) at 2025-01-18 22:30 IST
Nmap scan report for 10.10.11.38
Host is up (0.075s laten
https://github.com/aio-libs/aiohttp/commit/1c335944d6a8b1298baf179b7c0b3069f10c514bhttps://github.com/aio-libs/aiohttp/pull/8079https://github.com/aio-libs/aiohttp/security/advisories/GHSA-5h86-8mv2-jq9fhttps://lists.fedoraproject.org/archives/list/[email protected]/message/ICUOCFGTB25WUT336BZ4UNYLSZOUVKBD/https://lists.fedoraproject.org/archives/list/[email protected]/message/XXWVZIVAYWEBHNRIILZVB3R3SDQNNAA7/https://github.com/aio-libs/aiohttp/commit/1c335944d6a8b1298baf179b7c0b3069f10c514bhttps://github.com/aio-libs/aiohttp/pull/8079https://github.com/aio-libs/aiohttp/security/advisories/GHSA-5h86-8mv2-jq9fhttps://lists.debian.org/debian-lts-announce/2025/02/msg00002.htmlhttps://lists.fedoraproject.org/archives/list/[email protected]/message/ICUOCFGTB25WUT336BZ4UNYLSZOUVKBD/https://lists.fedoraproject.org/archives/list/[email protected]/message/XXWVZIVAYWEBHNRIILZVB3R3SDQNNAA7/https://www.exploit-db.com/exploits/52474
2024-01-29
Published
Exploited in the wild