Find, fix and prevent vulnerabilities in your code.

Overview

Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the request.read() method. An attacker can cause the server to consume excessive CPU resources by sending a large number of chunked messages.

Details

Denial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its intended and legitimate users.

Unlike other vulnerabilities, DoS attacks usually do not aim at breaching security. Rather, they are focused on making websites and services unavailable to genuine users resulting in downtime.

One popular Denial of Service vulnerability is DDoS (a Distributed Denial of Service), an attack that attempts to clog network pipes to the system by generating a large volume of traffic from many machines.

When it comes to open source libraries, DoS vulnerabilities allow attackers to trigger such a crash or crippling of the service by using a flaw either in the application code or from the use of open source libraries.

Two common types of DoS vulnerabilities:

• High CPU/Memory Consumption- An attacker sending crafted requests that could cause the system to take a disproportionate amount of time to process. For example, commons-fileupload:commons-fileupload.

• Crash - An attacker sending crafted requests that could cause the system to crash. For Example, npm ws package

Remediation

Upgrade aiohttp to version 3.13.3 or higher.

References

• GitHub Commit
• GitHub Commit

Overview

Affected versions of this package are vulnerable to Information Exposure over the /static endpoint. An attacker can determine the existence of internal path components by sending requests to probe for absolute path elements.

Remediation

Upgrade aiohttp to version 3.13.3 or higher.

References

• GitHub Commit

Overview

Affected versions of this package are vulnerable to Logging of Excessive Data via the cookies attribute. An attacker can generate excessive warning-level log entries by sending specially crafted Cookie headers.

Remediation

Upgrade aiohttp to version 3.13.3 or higher.

References

• GitHub Commit

Overview

Affected versions of this package are vulnerable to Infinite loop where an attacker can cause the application to stop responding by initiating a loop through functions affecting the Path module, such as joinpath, the overloaded division operator, and iterdir.

Details

Denial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its intended and legitimate users.

Unlike other vulnerabilities, DoS attacks usually do not aim at breaching security. Rather, they are focused on making websites and services unavailable to genuine users resulting in downtime.

One popular Denial of Service vulnerability is DDoS (a Distributed Denial of Service), an attack that attempts to clog network pipes to the system by generating a large volume of traffic from many machines.

When it comes to open source libraries, DoS vulnerabilities allow attackers to trigger such a crash or crippling of the service by using a flaw either in the application code or from the use of open source libraries.

Two common types of DoS vulnerabilities:

• High CPU/Memory Consumption- An attacker sending crafted requests that could cause the system to take a disproportionate amount of time to process. For example, commons-fileupload:commons-fileupload.

• Crash - An attacker sending crafted requests that could cause the system to crash. For Example, npm ws package

Remediation

Upgrade zipp to version 3.19.1 or higher.

References

• GitHub Commit
• GitHub Issue
• GitHub PR

Overview

Affected versions of this package are vulnerable to HTTP Request Smuggling due to improper validation of HTTP request elements. An attacker can potentially inject additional requests or cause unhandled exceptions leading to excessive resource consumption by exploiting leniencies in the HTTP parser and inconsistencies in error handling.

PoC

GET / HTTP/1ö1
GET / HTTP/1.𝟙
GET/: HTTP/1.1
Content-Encoding?: chunked

Remediation

Upgrade aiohttp to version 3.9.2 or higher.

References

• GitHub Commit
• GitHub Commit
• GitHub PR

Overview

Affected versions of this package are vulnerable to HTTP Request Smuggling via the unicode processing of HTTP header values. An attacker can bypass firewall or proxy protections by sending requests containing non-ASCII characters.

Note: This is only exploitable if C extensions are not in use (pure python installation) or if the AIOHTTP_NO_EXTENSIONS environment variable is enabled.

Remediation

Upgrade aiohttp to version 3.13.3 or higher.

References

• GitHub Commit

Overview

Affected versions of this package are vulnerable to HTTP Request Smuggling via the parsing of Range headers. An attacker can potentially interfere with HTTP request processing by supplying non-ASCII decimals in the header, which may lead to unexpected parser mismatches.

Remediation

Upgrade aiohttp to version 3.13.3 or higher.

References

• GitHub Commit

Overview

Affected versions of this package are vulnerable to UNIX Symbolic Link (Symlink) Following through the FileResponse class due to improper validation for compressed variants. An attacker can access files outside the intended directory by manipulating symbolic links to point to restricted areas by performing Path.stat() and Path.open() to send the file.

Note

This vulnerability impacts servers with static routes that contain compressed variants as symbolic links pointing outside the root directory or that permit users to upload or create such links.

Remediation

Upgrade aiohttp to version 3.10.2 or higher.

References

• GitHub Commit
• GitHub PR

Overview

urllib3 is a HTTP library with thread-safe connection pooling, file post, and more.

Affected versions of this package are vulnerable to Open Redirect due to the retries parameter being ignored during PoolManager instantiation. An attacker can access unintended resources or endpoints by leveraging automatic redirects when the application expects redirects to be disabled at the connection pool level.

Note:

requests and botocore users are not affected.

Workaround

This can be mitigated by disabling redirects at the request() level instead of the PoolManager() level.

Remediation

Upgrade urllib3 to version 2.5.0 or higher.

References

• GitHub Commit

Overview

Affected versions of this package are vulnerable to Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') via the configuration of static routes when the follow_symlinks option is set to True. An attacker can read arbitrary files on the system by exploiting the lack of validation for file paths to ensure they are within the specified root directory for static files.

Notes:

This vulnerability has been present since the introduction of the follow_symlinks parameter.

An application is only vulnerable with setup code like:

app.router.add_routes([
    web.static("/static", "static/", follow_symlinks=True),  # Remove follow_symlinks to avoid the vulnerability
])

Workaround

This vulnerability can be mitigated by disabling the follow_symlinks option if it is set to True, especially in environments beyond restricted local development. Additionally, using a reverse proxy server to handle static resources is recommended over serving static resources directly with aiohttp in production environments.

Remediation

Upgrade aiohttp to version 3.9.2 or higher.

References

• GitHub Commit
• GitHub Commit
• GitHub PR
• PoC
• Nuclei Templates
• Exploit DB

Overview

Affected versions of this package are vulnerable to Improper Input Validation via the ClientSession method. An attacker can modify the HTTP request or create a new HTTP request if they control the HTTP method.

Note: This is only exploitable if the attacker can control the HTTP method of the request.

Workaround

Perform manual validation of the user value (e.g. by restricting it to a few known values like GET, POST etc.).

Remediation

Upgrade aiohttp to version 3.9.0 or higher.

References

• GitHub Commit
• GitHub Gist

Overview

Affected versions of this package are vulnerable to Improper Input Validation in the ClientSession. An attacker can modify the HTTP request or create a new HTTP request by controlling the HTTP version of the request. If a list is passed, then it bypasses validation and it is possible to perform CRLF injection.

Note: The vulnerability only occurs if the attacker can control the HTTP version of the request (including its type).

Workaround

If these specific conditions are met and you are unable to upgrade, then validate the user input to the version parameter to ensure it is a str.

Remediation

Upgrade aiohttp to version 3.9.0 or higher.

References

• GitHub Commit
• GitHub Gist

Overview

Affected versions of this package are vulnerable to Cross-site Scripting (XSS) due to improper handling of index pages for static file serving when show_index is set to True. If users have the ability to upload files with arbitrary filenames to the static directory, an attacker can inject malicious scripts that will be executed in the context of the victim's browser session by crafting a file name that includes executable script content.

Note:

This is only exploitable if the server is configured to allow users to upload files to the static directory and show_index is enabled.

Workaround

This vulnerability can be mitigated by using a reverse proxy server (e.g., nginx) for serving static files, as recommended, or by disabling show_index if unable to upgrade.

Details

Cross-site scripting (or XSS) is a code vulnerability that occurs when an attacker “injects” a malicious script into an otherwise trusted website. The injected script gets downloaded and executed by the end user’s browser when the user interacts with the compromised website.

This is done by escaping the context of the web application; the web application then delivers that data to its users along with other trusted dynamic content, without validating it. The browser unknowingly executes malicious script on the client side (through client-side languages; usually JavaScript or HTML) in order to perform actions that are otherwise typically blocked by the browser’s Same Origin Policy.

Injecting malicious code is the most prevalent manner by which XSS is exploited; for this reason, escaping characters in order to prevent this manipulation is the top method for securing code against this vulnerability.

Escaping means that the application is coded to mark key characters, and particularly key characters included in user input, to prevent those characters from being interpreted in a dangerous context. For example, in HTML, < can be coded as &lt; and > can be coded as &gt; in order to be interpreted and displayed as themselves in text, while within the code itself, they are used for HTML tags. If malicious content is injected into an application that escapes special characters and that malicious content uses < and > as HTML tags, those characters are nonetheless not interpreted as HTML tags by the browser if they’ve been correctly escaped in the application code and in this way the attempted attack is diverted.

The most prominent use of XSS is to steal cookies (source: OWASP HttpOnly) and hijack user sessions, but XSS exploits have been used to expose sensitive information, enable access to privileged services and functionality and deliver malware.

Types of attacks

There are a few methods by which XSS can be manipulated:

Affected environments

The following environments are susceptible to an XSS attack:

• Web servers
• Application servers
• Web application environments

How to prevent

This section describes the top best practices designed to specifically protect your code:

• Sanitize data input in an HTTP request before reflecting it back, ensuring all data is validated, filtered or escaped before echoing anything back to the user, such as the values of query parameters during searches.
• Convert special characters such as ?, &, /, <, > and spaces to their respective HTML or URL encoded equivalents.
• Give users the option to disable client-side scripts.
• Redirect invalid requests.
• Detect simultaneous logins, including those from two separate IP addresses, and invalidate those sessions.
• Use and enforce a Content Security Policy (source: Wikipedia) to disable any features that might be manipulated for an XSS attack.
• Read the documentation for any of the libraries referenced in your code to understand which elements allow for embedded HTML.

Remediation

Upgrade aiohttp to version 3.9.4 or higher.

References

• GitHub Commit
• GitHub PR

MPL-2.0 license