aiohttp vulnerable to path traversal outside root directory

CVE-2024-42367

What is CVE-2024-42367?

Aiohttp, a popular asynchronous HTTP client/server framework for asyncio and Python, has a vulnerability impacting static routes containing compressed files with .gz or .br extensions. Specifically, when these compressed file variants are represented as symbolic links, they can allow path traversal outside the designated root directory. The underlying issue occurs due to insufficient checks performed on the requested URL when dealing with compressed files in the FileResponse class. While the framework has measures to prevent path traversal when follow_symlinks=False (which is the default setting), these protections are bypassed when accessing compressed variants. The issue has been addressed in version 3.10.2, which implements the necessary checks to ensure secure file handling.

References