CVE-2024-27306Medium· 6.1▾ Sunlitaiohttp Cross-site Scripting vulnerability on index pages for static file handling
▾ Sunlit zone — Low / medium · no exploitation signal
impact 33.6 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Jul 8.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via OSV
0.7%
Last analysed / modified upstream
A XSS vulnerability exists on index pages for static file handling.
When using web.static(..., show_index=True), the resulting index pages do not escape file names.
If users can upload files with arbitrary filenames to the static directory, the server is vulnerable to XSS attacks.
We have always recommended using a reverse proxy server (e.g. nginx) for serving static files. Users following the recommendation are unaffected.
Other users can disable show_index if unable to upgrade.
Patch: https://github.com/aio-libs/aiohttp/pull/8319/files
aiohttp < 3.9.4Upgrade to a patched release:
aiohttp 3.9.4Connected by shared product, vendor, weakness, or advisory.
CVE-2023-47627Medium· 5.3AIOHTTP has problems in HTTP parser (the python one, not llhttp)
CVE-2024-23334Medium· 5.9aiohttp is vulnerable to directory traversal
CVE-2024-52304Mediumaiohttp allows request smuggling due to incorrect parsing of chunk extensions
CVE-2024-30251High· 7.5aiohttp vulnerable to Denial of Service when trying to parse malformed POST requests
CVE-2023-49081High· 7.2aiohttp is an asynchronous HTTP client/server framework for asyncio and Python
CVE-2023-49082Medium· 5.3aiohttp is an asynchronous HTTP client/server framework for asyncio and Python