4.8

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2024-42367

CVE-2024-42367: In aiohttp, compressed files as symlinks are not protected from path traversal

Summary

Static routes which contain files with compressed variants (.gz or .br extension) were vulnerable to path traversal outside the root directory if those variants are symbolic links.

Details

The server protects static routes from path traversal outside the root directory when follow_symlinks=False (default). It does this by resolving the requested URL to an absolute path and then checking that path relative to the root. However, these checks are not performed when looking for compressed variants in the FileResponse class, and symbolic links are then automatically followed when performing Path.stat() and Path.open() to send the file.

Impact

Servers with static routes that contain compressed variants as symbolic links, pointing outside the root directory, or that permit users to upload or create such links, are impacted.

Patch: https://github.com/aio-libs/aiohttp/pull/8653/files

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2024-42367

CVE-2024-42367:

4.8

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
aiohttp	pip	< 3.10.2	3.10.2

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability lies in how aiohttp's FileResponse class handled symbolic links for compressed file variants (e.g., .gz, .br). The primary commit ce2e9758814527589b10759a20783fb03b98339f modifies the _get_file_path_stat_encoding method within aiohttp/web_fileresponse.py.

Before the patch, this method used compressed_path.stat() when checking for compressed versions of a requested file. The Path.stat() method resolves symbolic links by default. If a compressed file (e.g., styles.css.gz) was a symlink pointing outside the configured static directory, Path.stat() would return information about the target of the symlink, bypassing the server's path traversal protections that were applied to the original, non-compressed path. The fix involves changing compressed_path.stat() to compressed_path.lstat() (which does not follow symlinks) and explicitly checking if the path is a regular file using S_ISREG(st.st_mode).

The function aiohttp.web_fileresponse.FileResponse._get_file_path_stat_encoding is directly identified as vulnerable because it contained the Path.stat() call that led to the symlink being followed. The aiohttp.web_fileresponse.FileResponse.__init__ method is also included because it's the constructor that invokes _get_file_path_stat_encoding, making it the entry point for the vulnerable code path when a FileResponse object is created.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.