CVE-2024-23334 PoC — aiohttp 路径遍历漏洞

Source

https://github.com/ox1111/CVE-2024-23334

Associated Vulnerability

Title:aiohttp 路径遍历漏洞 (CVE-2024-23334)
Description:aiohttp是一个开源的用于 asyncio 和 Python 的异步 HTTP 客户端/服务器框架。 aiohttp 3.9.2之前版本存在路径遍历漏洞，该漏洞源于当follow_symlinks设置为 True 时，不会进行检查读取的文件是否位于根目录内，这可能会导致目录遍历漏洞。

Description

CVE-2024-23334

Readme

### [ CVE-2024-23334 :; 남의 exploit 리뷰 ]
Review an exploit published by someone else

### 악용시 본인 책임
Abuse at your own risk

https://nvd.nist.gov/vuln/detail/CVE-2024-23334

# 설치(install)
python -m pip install --upgrade pip

[ requirements.txt ]

aiohttp==3.9.1

pip install -r requirements.txt

pip show aiohttp

# test version
Version 3.9.1 

### 그림클릭하면 유튜브 재현동영상 Play
Click on the picture below to play YouTube


[![재현SpeeDr00t](exp.PNG)](https://youtu.be/DhRQVjspH6I)

File Snapshot


 [4.0K]  /data/pocs/a4ee982c87272e539eab110604a827fca022190c
├── [ 90K]  exp.PNG
├── [ 529]  README.md
├── [  15]  requirements.txt
└── [ 316]  victim.py

0 directories, 4 files

Shenlong Bot has cached this for you

Remarks

1. It is advised to access via the original source first.

2. If the original source is unavailable, please email f.jinxu#gmail.com for a local snapshot (replace # with @).

3. Shenlong has snapshotted the POC code for you. To support long-term maintenance, please consider donating. Thank you for your support.

Goal Reached Thanks to every supporter — we hit 100%!