Vulnerability · Published Aug 9, 2024 · Assigned by GitHub_M
CVE-2024-42367In aiohttp, compressed files as symlinks are not protected from path traversal
Medium 4.8
In plain English
A medium-severity security flaw in aiohttp from aio-libs. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 51% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. In versions on the 3.10 branch prior to version 3.10.2, static routes which contain files with compressed variants (`.gz` or `.br` extension) are vulnerable to path traversal outside the root directory if those variants are symbolic links. The server protects static routes from path traversal outside the root directory when `follow_symlinks=False` (default). It does this by resolving the requested URL to an absolute path and then checking that path relative to the root. However, these checks are not performed when looking for compressed variants in the `FileResponse` class, and symbolic links are then automatically followed when performing the `Path.stat()` and `Path.open()` to send the file. Version 3.10.2 contains a patch for the issue.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | python-aiohttp | no fix listed | DEBIAN-CVE-2024-42367 |
| Debian:13 | python-aiohttp | 3.10.3-2 | DEBIAN-CVE-2024-42367 |
| Debian:14 | python-aiohttp | 3.10.3-2 | DEBIAN-CVE-2024-42367 |
| PyPI | aiohttp | 3.10.2 | PYSEC-2026-1108 |
| PyPI | aiohttp | 3.10.2 | GHSA-jwhx-xcg6-8xhj |
| Ubuntu:22.04:LTS | python-aiohttp | no fix listed | UBUNTU-CVE-2024-42367 |
| Ubuntu:24.04:LTS | python-aiohttp | no fix listed | UBUNTU-CVE-2024-42367 |
Affected products (as reported)
Weakness: CWE-61 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
References
- https://github.com/aio-libs/aiohttp/security/advisories/GHSA-jwhx-xcg6-8xhj x_refsource_CONFIRM
- https://github.com/aio-libs/aiohttp/pull/8653 x_refsource_MISC
- https://github.com/aio-libs/aiohttp/commit/ce2e9758814527589b10759a20783fb03b98339f x_refsource_MISC
- https://github.com/aio-libs/aiohttp/blob/e0ff5246e1d29b7710ab1a2bbc972b48169f1c05/aiohttp/web_fileresponse.py#L177 x_refsource_MISC
- https://github.com/aio-libs/aiohttp/blob/e0ff5246e1d29b7710ab1a2bbc972b48169f1c05/aiohttp/web_urldispatcher.py#L674 x_refsource_MISC