A new Aiohttp vulnerability has been discovered, which the threat actor ShadowSyndicate exploits.
Aiohttp is an asynchronous HTTP client/server framework that has extensive capabilities and flexibility to make aiohttp perform various asynchronous tasks.
The ShadowSyndicate threat actor operates as a Ransomware-as-a-Service affiliate and has been active since July 2022.
The threat actor was responsible for several ransomware activities, including the Quantum, Nokoyawa, and ALPHV ransomware activities.
However, this vulnerability has been assigned CVE-2024-23334, and its severity has been given as 7.5 (High).
More than 43,000 internet-exposed instances have been identified worldwide using aiohttp framework.
Additionally, the aiohttp maintainers have provided a patch to fix this vulnerability.
Aiohttp framework is specifically designed to offer asynchronous HTTP client and server capabilities, which initially require the setting up of static routes for serving files in order to specify the root directory containing the static files.
Further, the framework has the option to allow follow_symlinks, which can be used to make the server follow symbolic links outside of the static root directory.
Alert Fatigue that helps no one as security teams need to triage 100s of vulnerabilities. :
AcuRisQ, that helps you to quantify risk accurately:
If the follow_symlinks is set to True, the path to be followed is not validated, giving rise to unauthorized arbitrary file reading vulnerability.
According to the reports shared with Cyber Security News, this CVE-2024-23334 is associated with directory traversal which could allow an unauthenticated remote threat actor to access sensitive information from arbitrary files on the vulnerable server.
This is done by traversing through the /static directory with the enabled follow_symlink option.
Moreover, the exposed instances have been highly found in the United States (6.93k), Germany (3.48k), Spain (2.48k), the United Kingdom (1.82k), Italy (1.81k), France (1.26k), Russia (1.25k) and China (1.16k).
In addition to this, a proof-of-concept for this vulnerability has also been released alongside a comprehensive YouTube video that demonstrates the exploitation technique.
According to the exploit code, the researcher has set up a server that contains the ‘follow_symlink’ option enabled.
This allows the researcher to perform a directory traversal and read an arbitrary file on the D:\ volume of the server.
Users of this aiohttp framework are recommended to upgrade to the latest version in order to prevent this vulnerability from getting exploited by threat actors.
| Indicators | Indicator Type | Description |
| 81[.]19[.]136[.]251 | IP | IP observed attempting to exploit CVE-2024-23334 |
| 157[.]230[.]143[.]100 | IP | IP observed attempting to exploit CVE-2024-23334 |
| 170[.]64[.]174[.]95 | IP | IP observed attempting to exploit CVE-2024-23334 |
| 103[.]151[.]172[.]28 | IP | IP observed attempting to exploit CVE-2024-23334 |
| 143[.]244[.]188[.]172 | IP | IP observed attempting to exploit CVE-2024-23334 |
Stay updated on Cybersecurity news, Whitepapers, and Infographics. Follow us on LinkedIn & Twitter.
Modern cars have microcontrollers that use the Controller Area Network (CAN) to perform safety and luxury functions. However, vehicle hijacking…
The latest Nexusguard DDoS Trend Report for 2024 has unveiled a significant escalation in the size of Distributed Denial of…
Researchers have identified a new form of cyberattack termed "LLMjacking," which exploits stolen cloud credentials to hijack cloud-hosted large language…
In a recent cybersecurity breakthrough, researchers have unveiled significant updates to the HijackLoader malware, a sophisticated modular loader notorious for…
The North Korean hacking group known as Kimsuky has been reported to employ sophisticated methods involving social media platforms and…
Dell Technologies recently disclosed a data breach involving a company portal that contained limited customer information related to purchases. The…