ghsa-7gpw-8wmc-pm8g
Vulnerability from github
Published
2024-04-18 13:45
Modified
2024-05-02 03:30
Severity ?
Summary
aiohttp Cross-site Scripting vulnerability on index pages for static file handling
Details
Summary
A XSS vulnerability exists on index pages for static file handling.
Details
When using web.static(..., show_index=True)
, the resulting index pages do not escape file names.
If users can upload files with arbitrary filenames to the static directory, the server is vulnerable to XSS attacks.
Workaround
We have always recommended using a reverse proxy server (e.g. nginx) for serving static files. Users following the recommendation are unaffected.
Other users can disable show_index
if unable to upgrade.
Patch: https://github.com/aio-libs/aiohttp/pull/8319/files
{ "affected": [ { "package": { "ecosystem": "PyPI", "name": "aiohttp" }, "ranges": [ { "events": [ { "introduced": "0" }, { "fixed": "3.9.4" } ], "type": "ECOSYSTEM" } ] } ], "aliases": [ "CVE-2024-27306" ], "database_specific": { "cwe_ids": [ "CWE-79" ], "github_reviewed": true, "github_reviewed_at": "2024-04-18T13:45:21Z", "nvd_published_at": "2024-04-18T15:15:29Z", "severity": "MODERATE" }, "details": "### Summary\n\nA XSS vulnerability exists on index pages for static file handling.\n\n### Details\n\nWhen using `web.static(..., show_index=True)`, the resulting index pages do not escape file names.\n\nIf users can upload files with arbitrary filenames to the static directory, the server is vulnerable to XSS attacks.\n\n### Workaround\n\nWe have always recommended using a reverse proxy server (e.g. nginx) for serving static files. Users following the recommendation are unaffected.\n\nOther users can disable `show_index` if unable to upgrade.\n\n-----\n\nPatch: https://github.com/aio-libs/aiohttp/pull/8319/files", "id": "GHSA-7gpw-8wmc-pm8g", "modified": "2024-05-02T03:30:32Z", "published": "2024-04-18T13:45:21Z", "references": [ { "type": "WEB", "url": "https://github.com/aio-libs/aiohttp/security/advisories/GHSA-7gpw-8wmc-pm8g" }, { "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-27306" }, { "type": "WEB", "url": "https://github.com/aio-libs/aiohttp/pull/8319" }, { "type": "WEB", "url": "https://github.com/aio-libs/aiohttp/pull/8319/files" }, { "type": "WEB", "url": "https://github.com/aio-libs/aiohttp/commit/28335525d1eac015a7e7584137678cbb6ff19397" }, { "type": "PACKAGE", "url": "https://github.com/aio-libs/aiohttp" }, { "type": "WEB", "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2EXRGTN2WG7VZLUZ7WOXU5GQJKCPPHKP" }, { "type": "WEB", "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NWEI6NIHZ3G7DURDZVMRK7ZEFC2BTD3U" }, { "type": "WEB", "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZIVBMPEY7WWOFMC3CWXFBRQPFECV4SW3" } ], "schema_version": "1.4.0", "severity": [ { "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "type": "CVSS_V3" } ], "summary": "aiohttp Cross-site Scripting vulnerability on index pages for static file handling" }
Loading...
Loading...
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.