## https://sploitus.com/exploit?id=9535FDBB-3AB6-53D0-A6F5-A9B7CE09ECF4
# CVE-2024-23334-PoC
This repository is a proof of concept (POC) for CVE-2024-23334, demonstrating an attempt to replicate the bug in aiohttp that leads to Local File Inclusion (LFI).
> [!CAUTION]
> Disclaimer: This POC is for educational purposes only. DO NOT use it in real-world scenarios.
## Install
1. Clone the repository and ser environment.
```bash
git clone https://github.com/Betan423/CVE-2024-23334-PoC
cd CVE-2024-23334-PoC
# run in virtual environment
python3 -m venv .env
chmod +x ./.env/bin/activate
source ./.env/bin/activate
pip3 install -r requirements.txt
```
2. host the server
```bash
python server.py
```
3. run the script
```
bash exploit.sh
```
or
```
python3 exploit.py -s http://localhost:8081
```
**Congratulations! You have successfully reproduced CVE-2024-23334.**
## You can create a symbolic link in the static folder to test follow_symlinks:
1. Create the symbolic link for test.txt in the static folder:
You need to create a test.txt file on your Desktop first.
```bash
cd static
ln -s ~/Desktop/test.txt test
```
2. View the test.txt file:
Go to http://localhost:8081/static/test, and you should be able to see the content of test.txt
## Reference
[CVE-2024-23334
](https://vulners.com/cve/CVE-2024-23334)
[jhonnybonny/CVE-2024-23334](https://github.com/jhonnybonny/CVE-2024-23334)
[z3rObyte/CVE-2024-23334-PoC](https://github.com/z3rObyte/CVE-2024-23334-PoC)