A new Aiohttp vulnerability has been discovered, which the threat actor ShadowSyndicate exploits.
Aiohttp is an asynchronous HTTP client/server framework that has extensive capabilities and flexibility to make aiohttp perform various asynchronous tasks.
The ShadowSyndicate threat actor operates as a Ransomware-as-a-Service affiliate and has been active since July 2022.
The threat actor was responsible for several ransomware activities, including the Quantum, Nokoyawa, and ALPHV ransomware activities.
However, this vulnerability has been assigned CVE-2024-23334, and its severity has been given as 7.5 (High).
More than 43,000 internet-exposed instances have been identified worldwide using aiohttp framework.
Additionally, the aiohttp maintainers have provided a patch to fix this vulnerability.
Aiohttp framework is specifically designed to offer asynchronous HTTP client and server capabilities, which initially require the setting up of static routes for serving files in order to specify the root directory containing the static files.
Further, the framework has the option to allow follow_symlinks, which can be used to make the server follow symbolic links outside of the static root directory.
Alert Fatigue that helps no one as security teams need to triage 100s of vulnerabilities. :
AcuRisQ, that helps you to quantify risk accurately:
If the follow_symlinks is set to True, the path to be followed is not validated, giving rise to unauthorized arbitrary file reading vulnerability.
According to the reports shared with Cyber Security News, this CVE-2024-23334 is associated with directory traversal which could allow an unauthenticated remote threat actor to access sensitive information from arbitrary files on the vulnerable server.
This is done by traversing through the /static directory with the enabled follow_symlink option.
Moreover, the exposed instances have been highly found in the United States (6.93k), Germany (3.48k), Spain (2.48k), the United Kingdom (1.82k), Italy (1.81k), France (1.26k), Russia (1.25k) and China (1.16k).
In addition to this, a proof-of-concept for this vulnerability has also been released alongside a comprehensive YouTube video that demonstrates the exploitation technique.
According to the exploit code, the researcher has set up a server that contains the ‘follow_symlink’ option enabled.
This allows the researcher to perform a directory traversal and read an arbitrary file on the D:\ volume of the server.
Users of this aiohttp framework are recommended to upgrade to the latest version in order to prevent this vulnerability from getting exploited by threat actors.
| Indicators | Indicator Type | Description |
| 81[.]19[.]136[.]251 | IP | IP observed attempting to exploit CVE-2024-23334 |
| 157[.]230[.]143[.]100 | IP | IP observed attempting to exploit CVE-2024-23334 |
| 170[.]64[.]174[.]95 | IP | IP observed attempting to exploit CVE-2024-23334 |
| 103[.]151[.]172[.]28 | IP | IP observed attempting to exploit CVE-2024-23334 |
| 143[.]244[.]188[.]172 | IP | IP observed attempting to exploit CVE-2024-23334 |
Stay updated on Cybersecurity news, Whitepapers, and Infographics. Follow us on LinkedIn & Twitter.
INE Security, a leading global provider of cybersecurity training and certifications, today announced a new…
In a groundbreaking discovery on November 20, 2024, cybersecurity researchers Shubham Shah and a colleague…
A security flaw found in Android-based kiosk tablets at luxury hotels has exposed a grave…
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) issued six Industrial Control Systems (ICS) advisories…
A sophisticated cyber campaign dubbed "J-magic" has been discovered targeting enterprise-grade Juniper routers with a…
In January, Netskope Threat Labs uncovered a sophisticated global malware campaign leveraging fake CAPTCHA pages…