关联漏洞
标题:
aiohttp 路径遍历漏洞
(CVE-2024-23334)
描述:aiohttp是一个开源的用于 asyncio 和 Python 的异步 HTTP 客户端/服务器框架。 aiohttp 3.9.2之前版本存在路径遍历漏洞,该漏洞源于当follow_symlinks设置为 True 时,不会进行检查读取的文件是否位于根目录内,这可能会导致目录遍历漏洞。
描述
This repository is a proof of concept (POC) for CVE-2024-23334, demonstrating an attempt to replicate the bug in aiohttp that leads to Local File Inclusion (LFI).
介绍
# CVE-2024-23334-PoC
This repository is a proof of concept (POC) for CVE-2024-23334, demonstrating an attempt to replicate the bug in aiohttp that leads to Local File Inclusion (LFI).
> [!CAUTION]
> Disclaimer: This POC is for educational purposes only. DO NOT use it in real-world scenarios.
## Install
1. Clone the repository and ser environment.
```bash
git clone https://github.com/Betan423/CVE-2024-23334-PoC
cd CVE-2024-23334-PoC
# run in virtual environment
python3 -m venv .env
chmod +x ./.env/bin/activate
source ./.env/bin/activate
pip3 install -r requirements.txt
```
2. host the server
```bash
python server.py
```
3. run the script
```
bash exploit.sh
```
or
```
python3 exploit.py -s http://localhost:8081
```
**Congratulations! You have successfully reproduced CVE-2024-23334.**
## You can create a symbolic link in the static folder to test follow_symlinks:
1. Create the symbolic link for test.txt in the static folder:
You need to create a test.txt file on your Desktop first.
```bash
cd static
ln -s ~/Desktop/test.txt test
```
2. View the test.txt file:
Go to http://localhost:8081/static/test, and you should be able to see the content of test.txt
## Reference
[CVE-2024-23334
](https://www.cve.org/CVERecord?id=CVE-2024-23334)
[jhonnybonny/CVE-2024-23334](https://github.com/jhonnybonny/CVE-2024-23334)
[z3rObyte/CVE-2024-23334-PoC](https://github.com/z3rObyte/CVE-2024-23334-PoC)
文件快照
[4.0K] /data/pocs/49db47bb8e21e6b69aa3b76ee6a2f459b9488402
├── [1.0K] exploit.py
├── [ 462] exploit.sh
├── [1.4K] README.md
├── [ 15] requirements.txt
├── [ 637] server.py
└── [4.0K] static
└── [ 21] file.txt
1 directory, 6 files
备注
1. 建议优先通过来源进行访问。
2. 如果因为来源失效或无法访问,请发送邮箱到 f.jinxu#gmail.com 索取本地快照(把 # 换成 @)。
3. 神龙已为您对POC代码进行快照,为了长期维护,请考虑为本地POC付费,感谢您的支持。