CVE-2024-23334
CVSS 3.1 Score 7.5 of 10 (high)
Details
Summary
CVE-2024-23334 is a vulnerability affecting the aiohttp framework, an asynchronous HTTP client/server framework for asyncio and Python. This vulnerability allows for directory traversal attacks, potentially leading to unauthorized access to arbitrary files on the system. The issue arises when configuring static routes and specifying the root path for static files. When the 'follow_symlinks' option is set to True, there is no validation to ensure that file reading stays within the root directory, even when symbolic links are not present. To remediate this vulnerability, it is recommended to disable 'follow_symlinks' and use a reverse proxy. A fix for this issue is available in version 3.9.2 of aiohttp. The potential danger of this vulnerability lies in the unauthorized access it enables, posing a high risk to organizations' confidentiality and potentially leading to data breaches or further compromise of the system.
Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.
Advisories, Assessments, and Mitigations
Prioritize, Pinpoint, and Act to Prevent Vulnerability Exploits with Recorded Future
- Gain complete coverage of your cyber, third party, and physical attack surface
- Proactively mitigate threats before they turn into costly attacks
- Make fast, effective, data-driven decisions