Skip to content

XSS on index pages for static file handling

Low
Dreamsorcerer published GHSA-7gpw-8wmc-pm8g Apr 17, 2024

Package

pip aiohttp (pip)

Affected versions

<3.9.4

Patched versions

3.9.4

Description

Summary

A XSS vulnerability exists on index pages for static file handling.

Details

When using web.static(..., show_index=True), the resulting index pages do not escape file names.

If users can upload files with arbitrary filenames to the static directory, the server is vulnerable to XSS attacks.

Workaround

We have always recommended using a reverse proxy server (e.g. nginx) for serving static files. Users following the recommendation are unaffected.

Other users can disable show_index if unable to upgrade.


Patch: https://github.com/aio-libs/aiohttp/pull/8319/files

Severity

Low

CVE ID

CVE-2024-27306

Weaknesses

Credits