Security
Headlines
HeadlinesLatestCVEs

Headline

GHSA-7gpw-8wmc-pm8g: aiohttp Cross-site Scripting vulnerability on index pages for static file handling

Summary

A XSS vulnerability exists on index pages for static file handling.

Details

When using web.static(..., show_index=True), the resulting index pages do not escape file names.

If users can upload files with arbitrary filenames to the static directory, the server is vulnerable to XSS attacks.

Workaround

We have always recommended using a reverse proxy server (e.g. nginx) for serving static files. Users following the recommendation are unaffected.

Other users can disable show_index if unable to upgrade.


Patch: https://github.com/aio-libs/aiohttp/pull/8319/files

ghsa
#xss#vulnerability#web#git#nginx

Summary

A XSS vulnerability exists on index pages for static file handling.

Details

When using web.static(…, show_index=True), the resulting index pages do not escape file names.

If users can upload files with arbitrary filenames to the static directory, the server is vulnerable to XSS attacks.

Workaround

We have always recommended using a reverse proxy server (e.g. nginx) for serving static files. Users following the recommendation are unaffected.

Other users can disable show_index if unable to upgrade.

Patch: https://github.com/aio-libs/aiohttp/pull/8319/files

References

  • GHSA-7gpw-8wmc-pm8g
  • https://github.com/aio-libs/aiohttp/pull/8319/files
  • aio-libs/aiohttp@2833552

Related news

Red Hat Security Advisory 2024-3781-03

Red Hat Security Advisory 2024-3781-03 - An update is now available for Red Hat Ansible Automation Platform 2.4. Issues addressed include HTTP request smuggling, buffer overflow, code execution, cross site scripting, denial of service, memory exhaustion, null pointer, and password leak vulnerabilities.