DirectorySecurity Advisories
Sign In
Security Advisories

CGA-jrf3-556m-q585

Published

Last updated

https://images.chainguard.dev/security/CGA-jrf3-556m-q585
Package

request-1276

Latest Update
Fixed
Fixed Version

0.20.1-r0

Aliases
  • CVE-2024-27306
  • GHSA-7gpw-8wmc-pm8g

Severity

6.1

Medium

CVSS V3

Summary

aiohttp Cross-site Scripting vulnerability on index pages for static file handling

Description

Summary

A XSS vulnerability exists on index pages for static file handling.

Details

When using web.static(..., show_index=True), the resulting index pages do not escape file names.

If users can upload files with arbitrary filenames to the static directory, the server is vulnerable to XSS attacks.

Workaround

We have always recommended using a reverse proxy server (e.g. nginx) for serving static files. Users following the recommendation are unaffected.

Other users can disable show_index if unable to upgrade.


Patch: https://github.com/aio-libs/aiohttp/pull/8319/files

References

Updates


Safe Source for Open Sourceâ„¢
Media KitContact Us
© 2024 Chainguard. All Rights Reserved.
Private PolicyTerms of Use

Product

Chainguard Images