Hackers exploit Aiohttp vulnerability to scan for vulnerable networks

The ransomware group ShadowSyndicate has recently been observed scanning for servers vulnerable to CVE-2024-23334, a directory traversal vulnerability in the aiohttp Python library.

Aiohttp is an open-source library built on top of Python's asynchronous I/O framework Asyncio, which can handle a large number of concurrent HTTP requests without traditional thread-based networking.

It is used by technology companies, web developers, backend engineers, and data scientists to build high-performance web applications and services that aggregate data from multiple external APIs.

On 28 January 2024, aiohttp released version 3.9.2, addressing CVE-2024-23334, a high-severity path traversal vulnerability affecting all aiohttp versions 3.9.1 and earlier, which allows unauthenticated remote attackers to access files on vulnerable servers.

The vulnerability is caused by insufficient validation when "follow_symlinks" is set to "True" for static routes, allowing unauthorised access to files outside the server's static root directory.

On 27 February 2024, a researcher released a proof-of-concept (PoC) exploit for CVE-2024-23334 on GitHub, and a detailed video showcasing step-by-step exploit instructions was posted on YouTube in early March.

Reportedly, exploit attempts targeting CVE-2024-23334 have been captured starting 29 February and continued at a higher rate into March.

The scanning attempts originated from five IP addresses, one of which was flagged by Group-IB in a September 2023 report, linking it to the ShadowSyndicate ransomware actors.

Observed attack IPs

ShadowSyndicate is an opportunistic, financially motivated actor active since July 2022, associated to varying degrees with ransomware operations including Quantum, Nokoyawa, BlackCat/ALPHV, Cl0p, Royal, Cactus, and Play.

Group-IB believes the threat actor is an affiliate working with multiple ransomware operations.

The findings indicate that attackers may be scanning servers using vulnerable versions of the aiohttp library. It remains unclear whether these scans lead to further intrusions.

Regarding the attack surface, Cyble's internet scanner ODIN shows approximately 44,170 aiohttp instances exposed to the internet worldwide. The majority (15.8%) are located in the United States, followed by Germany (8%), Spain (5.7%), the UK, Italy, France, Russia, and China.

Exposed aiohttp instances (Cyble)

Due to the inability to identify the version of internet-exposed instances, it is difficult to determine the exact number of vulnerable aiohttp servers.

Unfortunately, due to various practical challenges, open-source libraries are often used in outdated versions for a long time, making locating and patching them complex.

This makes them highly valuable to attackers, who continue to exploit them even years after security updates are released.

Attack simulation rules targeting this exploit have been integrated into the Securityworks Active Validation Platform. If you are using Aiohttp in your environment, you can search for keywords like "Aiohttp" or "CVE-2024-23334" in the Securityworks Active Validation Platform to access relevant attack simulation validation actions. This will allow you to verify whether your security defence system can effectively counter the vulnerability. The platform ensures your validation process is safe and harmless in an industry-unique manner.

Securityworks recommends that organisations using the Aiohttp library, even if unsure of their vulnerability, proactively validate their defensive posture as soon as possible to achieve active defence and reduce the risk of compromise.