CVE-2024-27306 aiohttp vulnerable to XSS on index pages for static file handling
Cross-site scripting vulnerability in aiohttp static file index pages allows attackers to execute scripts, affecting users who enable show_index.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2024-27306?
CVE-2024-27306 is a medium-severity cross-site scripting vulnerability in Fedoraproject Fedora, published on 18 Apr 2024. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. A XSS vulnerability exists on index pages for static file handling. This vulnerability is fixed in 3.9.4. We have always recommended using a reverse proxy server (e.g. nginx) for serving static files. Users following the recommendation are unaffected. Other users can disable `show_index` if unable to upgrade.
Which versions are affected by CVE-2024-27306?
3 open source packages ship an affected version, including aiohttp. It affects 2 products.
| Package | Affected | Fixed in |
|---|---|---|
aiohttp PyPI | All versions | 3.9.4 |
aiohttp PyPI | All versions | 3.9.4 |
aiohttp PyPI | All versions | 3.9.4 |
Linux distribution packages (12)
python-aiohttp SUSE:Linux Enterprise Module for Public Cloud 15 SP2 | All versions | 3.6.0-150100.3.24.1 |
python-aiohttp SUSE:Linux Enterprise Module for Public Cloud 15 SP3 | All versions | 3.6.0-150100.3.24.1 |
python-aiohttp SUSE:Linux Enterprise Module for Public Cloud 15 SP4 | All versions | 3.6.0-150100.3.24.1 |
python-aiohttp SUSE:Linux Enterprise Module for Public Cloud 15 SP4 | All versions | 3.9.3-150400.10.21.1 |
python-aiohttp SUSE:Linux Enterprise Module for Public Cloud 15 SP5 | All versions | 3.6.0-150100.3.24.1 |
python-aiohttp SUSE:Linux Enterprise Module for Public Cloud 15 SP6 | All versions | 3.6.0-150100.3.24.1 |
python-aiohttp SUSE:Linux Enterprise Module for Python 3 15 SP5 | All versions | 3.9.3-150400.10.21.1 |
python-aiohttp SUSE:Linux Enterprise Module for Python 3 15 SP6 | All versions | 3.9.3-150400.10.21.1 |
python-aiohttp openSUSE:Leap 15.5 | All versions | 3.6.0-150100.3.24.1 |
python-aiohttp openSUSE:Leap 15.5 | All versions | 3.9.3-150400.10.21.1 |
python-aiohttp openSUSE:Leap 15.6 | All versions | 3.9.3-150400.10.21.1 |
python-aiohttp openSUSE:Tumbleweed | All versions | 3.9.5-2.1 |
Products include Aiohttp Aiohttp, Fedoraproject Fedora.
How do I fix CVE-2024-27306?
Upgrade aiohttp to 3.9.4 or later.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2024-27306 being exploited?
There is no known exploitation of CVE-2024-27306 in the wild and no public exploit code.
Other vulnerabilities in Fedoraproject Fedora
- CVE-2024-52303 aiohttp memory leak when middleware is enabled when requesting a resource with a non-allowed method
- CVE-2025-69223 AIOHTTP's HTTP Parser auto_decompress feature is vulnerable to zip bomb
- CVE-2024-30251 Denial of service when trying to parse malformed POST requests in aiohttp
- CVE-2023-49081 aiohttp's ClientSession is vulnerable to CRLF injection via version
- CVE-2026-22815 AIOHTTP: Uncapped memory usage possible through aiohttp allowing unlimited trailer headers
Sources
Also known as AZL-43357, AZL-43372, DEBIAN-CVE-2024-27306, ECHO-69fb-b299-e120, GHSA-7gpw-8wmc-pm8g, MGASA-2024-0235 and 6 more.