CVE-2024-23334-PoC

This repository is a proof of concept (POC) for CVE-2024-23334, demonstrating an attempt to replicate the bug in aiohttp that leads to Local File Inclusion (LFI).

[!CAUTION] Disclaimer: This POC is for educational purposes only. DO NOT use it in real-world scenarios.

Install

1. Clone the repository and ser environment.

git clone https://github.com/Betan423/CVE-2024-23334-PoC
cd CVE-2024-23334-PoC
# run in virtual environment
python3 -m venv .env
chmod +x ./.env/bin/activate
source ./.env/bin/activate
pip3 install -r requirements.txt

2. host the server

python server.py

3. run the script

bash exploit.sh

or

python3 exploit.py -s http://localhost:8081

Congratulations! You have successfully reproduced CVE-2024-23334.

You can create a symbolic link in the static folder to test follow_symlinks: