CVE-2024-42367

Summary

CVE-2024-42367 is a vulnerability affecting the aiohttp library, a popular asynchronous HTTP client/server framework for Python and asyncio. Before version 3.10.2, the library failed to adequately protect against path traversal attacks on static routes containing compressed files (with `.gz` or `.br` extensions) that are symbolic links. The server's default configuration, which sets `follow_symlinks=False`, prevents path traversal outside the root directory by checking absolute paths against the root. However, this protection is bypassed when dealing with compressed files in the `FileResponse` class, causing symbolic links to be automatically followed during `Path.stat()` and `Path.open()` operations. Version 3.10.2 addresses this issue with a patch.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.