Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') Affecting aiohttp package, versions [1.0.5,3.9.2)

Affected versions of this package are vulnerable to Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') via the configuration of static routes when the follow_symlinks option is set to True. An attacker can read arbitrary files on the system by exploiting the lack of validation for file paths to ensure they are within the specified root directory for static files.

Notes:

This vulnerability has been present since the introduction of the follow_symlinks parameter.

An application is only vulnerable with setup code like:

app.router.add_routes([
    web.static("/static", "static/", follow_symlinks=True),  # Remove follow_symlinks to avoid the vulnerability
])

This vulnerability can be mitigated by disabling the follow_symlinks option if it is set to True, especially in environments beyond restricted local development. Additionally, using a reverse proxy server to handle static resources is recommended over serving static resources directly with aiohttp in production environments.

• GitHub Commit
• GitHub Commit
• GitHub PR
• PoC
• Nuclei Templates