Aiohttp Vulnerability in Attacker Crosshairs

Hackers are apparently attempting to exploit a recently patched Aiohttp vulnerability that could impact thousands of servers worldwide, according to threat intelligence firm Cyble.
Aiohttp is an open source asynchronous HTTP client/server framework for Asyncio and Python.
There are dozens of libraries built on top of Aiohttp and it powers the websites of several major companies.
A Shodan search for 'aiohttp' shows more than 70,000 results worldwide, including many in the United States, China and Germany.
Cyble's own scanner has identified 43,000 internet-exposed instances, with significant percentages seen in the US and Europe.
Many of these systems could be impacted by CVE-2024-23334, a high-severity path traversal vulnerability patched in late January with the release of version 3.9.2.
The flaw can be exploited by remote, unauthenticated attackers to access sensitive information from arbitrary files stored on the targeted server.
A proof-of-concept exploit for CVE-2024-23334 was made public in late February and Cyble started seeing scanning activity shortly after.
The cybersecurity firm noticed exploitation attempts coming from multiple IP addresses, including one previously linked to a cybercrime group named ShadowSyndicate.
The threat actor has been active since at least July 2022, according to a recent report from Group-IB. ShadowSyndicate is believed to be a ransomware-as-a-service affiliate that has worked with several ransomware operations, including Royal, Cl0p, Play and Cactus.
There does not appear to be conclusive evidence that the vulnerability has been successfully exploited to hack into organizations' systems, but the fact that threat actors have set their sights on the flaw is concerning.


This Cyber News was published on www.securityweek.com. Publication date: Tue, 19 Mar 2024 10:43:06 +0000


Cyber News related to Aiohttp Vulnerability in Attacker Crosshairs

CVE-2023-37276 - aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. aiohttp v3.8.4 and earlier are bundled with llhttp v6.0.6. Vulnerable code is used by aiohttp for its HTTP request parser when available which is the default case when ...
1 year ago
Hackers exploit Aiohttp bug to find vulnerable networks - The ransomware actor 'ShadowSyndicate' was observed scanning for servers vulnerable to CVE-2024-23334, a directory traversal vulnerability in the aiohttp Python library. Aiohttp is an open-source library built on top of Python's asynchronous I/O ...
1 year ago Bleepingcomputer.com CVE-2024-23334 Cactus
CVE-2021-21330 - aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. In aiohttp before version 3.7.4 there is an open redirect vulnerability. A maliciously crafted link to an aiohttp-based web-server could redirect the browser to a ...
2 years ago
Aiohttp Vulnerability in Attacker Crosshairs - Hackers are apparently attempting to exploit a recently patched Aiohttp vulnerability that could impact thousands of servers worldwide, according to threat intelligence firm Cyble. Aiohttp is an open source asynchronous HTTP client/server framework ...
1 year ago Securityweek.com CVE-2024-23334 Cactus
CVE-2023-47641 - aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. Affected versions of aiohttp have a security vulnerability regarding the inconsistent interpretation of the http protocol. HTTP/1.1 is a persistent protocol, if both ...
8 months ago
CVE-2024-30251 - aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. In affected versions an attacker can send a specially crafted POST (multipart/form-data) request. When the aiohttp server processes it, the server will enter an infinite ...
1 year ago
CVE-2024-52304 - aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.10.11, the Python parser parses newlines in chunk extensions incorrectly which can lead to request smuggling vulnerabilities under certain conditions. ...
5 months ago Tenable.com
CVE-2024-52303 - aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. In versions starting with 3.10.6 and prior to 3.10.11, a memory leak can occur when a request produces a MatchInfoError. This was caused by adding an entry to a cache on ...
5 months ago Tenable.com
CVE-2018-1000519 - aio-libs aiohttp-session contains a Session Fixation vulnerability in load_session function for RedisStorage (see: https://github.com/aio-libs/aiohttp-session/blob/master/aiohttp_session/redis_storage.py#L42) that can result in Session Hijacking. ...
6 years ago
CVE-2025-25305 - Home Assistant Core is an open source home automation that puts local control and privacy first. Affected versions are subject to a potential man-in-the-middle attacks due to missing SSL certificate verification in the project codebase and used ...
2 months ago Tenable.com
CVE-2023-47627 - aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. The HTTP parser in AIOHTTP has numerous problems with header parsing, which could lead to request smuggling. This parser is only used when AIOHTTP_NO_EXTENSIONS is ...
1 year ago
CVE-2024-23334 - aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. When using aiohttp as a web server and configuring static routes, it is necessary to specify the root path for static files. Additionally, the option ...
1 year ago
In the Crosshairs: Addressing Emerging Threats Through Adaptive Software Development - To counteract these ever-changing threats, organizations must adopt adaptive responses that can dynamically adjust to new challenges and vulnerabilities. This article zeroes in on the crucial intersection of adaptive software development and ...
1 year ago Cybersecuritynews.com
CVE-2023-49082 - aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. Improper validation makes it possible for an attacker to modify the HTTP request (e.g. insert a new header) or even create a new HTTP request if the attacker controls the ...
1 year ago
CVE-2023-49081 - aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. Improper validation made it possible for an attacker to modify the HTTP request (e.g. to insert a new header) or create a new HTTP request if the attacker controls the ...
1 year ago
CVE-2024-27306 - aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. A XSS vulnerability exists on index pages for static file handling. This vulnerability is fixed in 3.9.4. We have always recommended using a reverse proxy server (e.g. ...
1 year ago
CVE-2024-23829 - aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. Security-sensitive parts of the Python HTTP parser retained minor differences in allowable character sets, that must trigger error handling to robustly match frame ...
1 year ago
CVE-2018-1000814 - aio-libs aiohttp-session version 2.6.0 and earlier contains a Other/Unknown vulnerability in EncryptedCookieStorage and NaClCookieStorage that can result in Non-expiring sessions / Infinite lifespan. This attack appear to be exploitable via ...
5 years ago
CVE-2022-33124 - AIOHTTP 3.8.1 can report a "ValueError: Invalid IPv6 URL" outcome, which can lead to a Denial of Service (DoS). NOTE: multiple third parties dispute this issue because there is no example of a context in which denial of service would occur, ...
11 months ago
CVE-2024-42367 - aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.10.2, static routes which contain files with compressed variants (`.gz` or `.br` extension) are vulnerable to path traversal outside the root directory ...
9 months ago
Rootkit Turns Kubernetes from Orchestration to Subversion - As software development focuses on continuous integration and deployment, orchestration platforms like Kubernetes have taken off, but that popularity has put them in attackers' crosshairs. Most successful attacks - at least those publicly reported - ...
1 year ago Darkreading.com
Recent Apache Struts 2 Vulnerability in Attacker Crosshairs - Threat actors have started probing internet-accessible Apache Struts 2 instances affected by a recently disclosed remote code execution flaw. The critical-severity bug, tracked as CVE-2023-50164, was disclosed a week ago, when the Apache Software ...
1 year ago Securityweek.com CVE-2023-50164
Critical Apache OFBiz Vulnerability in Attacker Crosshairs - The Shadowserver Foundation has been seeing attempts to exploit a critical vulnerability affecting the Apache OFBiz open source enterprise resource planning system. Apache OFBiz is leveraged by several ERP and other types of projects, including the ...
1 year ago Securityweek.com CVE-2023-49070 CVE-2023-51467 CVE-2023-50164 CVE-2023-46604
Critical Apache OFBiz Vulnerability in Attacker Crosshairs - The Shadowserver Foundation has been seeing attempts to exploit a critical vulnerability affecting the Apache OFBiz open source enterprise resource planning system. Apache OFBiz is leveraged by several ERP and other types of projects, including the ...
1 year ago Packetstormsecurity.com CVE-2023-49070 CVE-2023-51467 CVE-2023-50164 CVE-2023-46604
Vulnerability Summary for the Week of February 12, 2024 - Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Application Object Library. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise ...
1 year ago Cisa.gov

Cyber Trends (last 7 days)