Hackers exploit Aiohttp bug to find vulnerable networks

The ransomware actor 'ShadowSyndicate' was observed scanning for servers vulnerable to CVE-2024-23334, a directory traversal vulnerability in the aiohttp Python library. Aiohttp is an open-source library built on top of Python's asynchronous I/O framework, Asyncio, to handle large amounts of concurrent HTTP requests without traditional thread-based networking. It is used by tech firms, web developers, backend engineers, and data scientists looking to build high-performance web applications and services that aggregate data from multiple external APIs. On January 28, 2024, aiohttp released version 3.9.2, addressing CVE-2024-23334, a high-severity path traversal flaw impacting all versions of aiohttp from 3.9.1 and older that allows unauthenticated remote attackers to access files on vulnerable servers. The flaw is due to inadequate validation when 'follow_symlinks' is set to 'True' for static routes, allowing unauthorized access to files outside the server's static root directory. On February 27, 2024, a researcher released a proof of concept (PoC) exploit for CVE-2024-23334 on GitHub, while a detailed video showcasing step-by-step exploitation instructions was published on YouTube at the start of March. Cyble's threat analysts report that their scanners have caught exploitation attempts targeting CVE-2024-23334 starting on February 29 and continuing at an increased rate into March. The scanning attempts originate from five IP addresses, one of which was tagged in a September ...