GHSA-jwhx-xcg6-8xhj CVE-2024-42367 PYSEC-2026-1108
In aiohttp, compressed files as symlinks are not protected from path traversal
- Severity
- 0.0 / 10
- Medium · CVSS 4.0
- Exploit chance (EPSS)
- 0.65%
- Chance of exploitation in the next 30 days. Higher than 51.17% of scored vulnerabilities.
- Known exploited
- No
- Not in CISA's catalog
- Weakness
- CWE-61 UNIX Symbolic Link (Symlink) Following
- Fix
3.10.2- Upgrade aiohttp to this version or later
Description
Summary
Static routes which contain files with compressed variants (.gz or .br extension) were vulnerable to path traversal outside the root directory if those variants are symbolic links.
Details
The server protects static routes from path traversal outside the root directory when follow_symlinks=False (default). It does this by resolving the requested URL to an absolute path and then checking that path relative to the root. However, these checks are not performed when looking for compressed variants in the FileResponse class, and symbolic links are then automatically followed when performing Path.stat() and Path.open() to send the file.
Impact
Servers with static routes that contain compressed variants as symbolic links, pointing outside the root directory, or that permit users to upload or create such links, are impacted.
Affected versions
PyPI
| Package | Vulnerable | Fixed in |
|---|---|---|
| aiohttp | >= 3.10.0b1, < 3.10.2 |
3.10.2 |
How to fix
Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.
aiohttp PyPI → 3.10.2
- pip
pip install --upgrade "aiohttp>=3.10.2"- poetry
poetry add "aiohttp>=3.10.2"- uv
uv add "aiohttp>=3.10.2"
Severity breakdown
CVSS 4.0 0.0
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
- Attack vector
- Network
- Attack complexity
- High
- Attack requirements
- Present
- Privileges required
- None
- User interaction
- None
- Confidentiality (vulnerable system)
- Low
- Integrity (vulnerable system)
- Low
- Availability (vulnerable system)
- None
- Confidentiality (subsequent systems)
- None
- Integrity (subsequent systems)
- None
- Availability (subsequent systems)
- None
CVSS 3.1 4.8
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
- Attack vector
- Network
- Attack complexity
- High
- Privileges required
- None
- User interaction
- None
- Scope
- Unchanged
- Confidentiality
- Low
- Integrity
- Low
- Availability
- None
Weakness
CWE-61: UNIX Symbolic Link (Symlink) Following
The product, when opening a file or directory, does not sufficiently account for when the file is a symbolic link that resolves to a target outside of the intended control sphere. This could allow an attacker to cause the product to operate on unauthorized files.
How to prevent it
- Implementation: Symbolic link attacks often occur when a program creates a tmp directory that stores files/links. Access to the directory should be restricted to the program as to prevent attackers from manipulating the files.
- Architecture and Design: Follow the principle of least privilege when assigning access rights to entities in a software system. Denying access to a file can prevent an attacker from replacing that file with a link to a sensitive file. Ensure good compartmentalization in the system to provide protected areas that can be trusted.
References
Advisories
Packages
Other links
- github.com/aio-libs/aiohttp/security/advisories/GHSA-jwhx-xcg6-8xhj
- github.com/aio-libs/aiohttp/pull/8653
- github.com/aio-libs/aiohttp/commit/ce2e9758814527589b10759a20783fb03b98339f
- github.com/aio-libs/aiohttp/blob/e0ff5246e1d29b7710ab1a2bbc972b48169f1c05/aioht…
- github.com/aio-libs/aiohttp/blob/e0ff5246e1d29b7710ab1a2bbc972b48169f1c05/aioht…
Timeline
- Published
- Last updated by the source
- Latest EPSS score
Related advisories
| Advisory | Severity | Why it's related |
|---|---|---|
| GHSA-pqxq-w44r-73xw AIOHTTP: Pure-Python parser request smuggling | Medium | Also affects aiohttp |
| GHSA-gx76-c99x-2c96 AIOHTTP: Cookie from subdomain can remove Host-Only Scope from existing cookies | Low | Also affects aiohttp |
| GHSA-f9xw-jh8m-3mwq AIOHTTP: Absolute-form request targets can spoof Request.scheme | Medium | Also affects aiohttp |
| GHSA-9xw5-w5jj-pvcg AIOHTTP: File descriptor exhaustion in multipart requests | High | Also affects aiohttp |
| GHSA-6cjc-53gc-5rqm AIOHTTP: Connector pool exhaustion via Max-Age overflow | Medium | Also affects aiohttp |
| GHSA-5wr8-gcqf-gqf3 aiohttp server lacks an initial request/header timeout | High | Also affects aiohttp |
| GHSA-494j-54xm-rwp3 AIOHTTP: Secure attribute not enforced for shared cookie | Medium | Also affects aiohttp |
| GHSA-2g87-pp6c-29x5 aiohttp: Multiple instances of excessive or unbounded memory/CPU use | High | Also affects aiohttp |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor