CVE-2024-27306: aiohttp vulnerable to XSS on index pages for static file handling
Summary
A XSS vulnerability exists on index pages for static file handling.
Details
When using web.static(..., showindex=True), the resulting index pages do not escape file names.
If users can upload files with arbitrary filenames to the static directory, the server is vulnerable to XSS attacks.
Workaround
We have always recommended using a reverse proxy server (e.g. nginx) for serving static files. Users following the recommendation are unaffected.
Other users can disable showindex if unable to upgrade.
-----
Patch: https://github.com/aio-libs/aiohttp/pull/8319/files
Other sources
aio-libs aiohttp is vulnerable to cross-site scripting, caused by improper validation of user-supplied input. A remote attacker could exploit this vulnerability using a specially crafted URL to execute script in a victim's Web browser within the security context of the hosting Web site, once the URL is clicked. An attacker could use this vulnerability to steal the victim's cookie-based authentication credentials.
— IBM
aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. A XSS vulnerability exists on index pages for static file handling. This vulnerability is fixed in 3.9.4. We have always recommended using a reverse proxy server (e.g. nginx) for serving static files. Users following the recommendation are unaffected. Other users can disable showindex if unable to upgrade.
— NVD
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
pip/aiohttpto a version that resolves this vulnerability.Fixed in 3.9.4 - Upgrade
Upgrade
redhat/aiohttpto a version that resolves this vulnerability.Fixed in 3.9.4 - Upgrade
Upgrade
aio-libs aiohttpto a version that resolves this vulnerability.Fixed in 3.9.4 - Configuration
If you cannot upgrade, disable directory index display by setting web.static(..., show_index=False) (i.e., disable show_index) so that index pages for static file handling are not generated with unescaped filenames.
aio-libs aiohttp static file handling (web.static) show_index = False - Compensating control
Serve static files via a reverse proxy (e.g., nginx) rather than using aiohttp's built-in static file handling, as recommended in the material, to avoid exposure of aiohttp index pages for static file handling.
Event History
Frequently Asked Questions
What is the severity of CVE-2024-27306?
CVE-2024-27306 is considered a moderate severity XSS vulnerability due to improper file name escaping.
How do I fix CVE-2024-27306?
To fix CVE-2024-27306, update aiohttp to version 3.9.4 or later.
What specific functionality is affected by CVE-2024-27306?
CVE-2024-27306 affects the static file handling feature when using `web.static(..., show_index=True)`.
Can arbitrary file names exploit CVE-2024-27306?
Yes, arbitrary file names uploaded to the static directory can exploit CVE-2024-27306.
Which versions of aiohttp are vulnerable to CVE-2024-27306?
Aiohttp versions prior to 3.9.4 are vulnerable to CVE-2024-27306.