CVE-2024-27306: 
Wolfi vulnerability analysis and mitigation

A cross-site scripting (XSS) vulnerability was discovered in aiohttp, an asynchronous HTTP client/server framework for asyncio and Python. The vulnerability (CVE-2024-27306) exists on index pages for static file handling when using the show_index feature. The issue was fixed in version 3.9.4 (GitHub Advisory).

The vulnerability occurs when using web.static(..., show_index=True), where the resulting index pages do not properly escape file names. If users can upload files with arbitrary filenames to the static directory, the server becomes vulnerable to XSS attacks. The issue has been assigned a CVSS v3.1 base score of 6.1 MEDIUM (Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) (NVD).

If exploited, this vulnerability could allow attackers to execute arbitrary JavaScript code in the context of users' browsers when they view directory listings of static files. This could potentially lead to theft of session cookies, credentials, or other sensitive information from users viewing the affected pages (GitHub Advisory).

The vulnerability can be exploited by uploading files with malicious filenames containing JavaScript code to a directory served by aiohttp with show_index enabled. The attack requires user interaction as victims need to visit the affected directory listing page (GitHub Advisory).

Users are recommended to upgrade to aiohttp version 3.9.4 or later which contains the fix. For those unable to upgrade immediately, there are two workarounds: 1) Use a reverse proxy server (e.g., nginx) for serving static files, which has always been the recommended approach, or 2) Disable the show_index feature if not required (GitHub Advisory).

The vulnerability has been acknowledged and addressed by multiple Linux distributions including Fedora, which has released security updates for versions 38, 39, and 40 to address this issue (Fedora Update).