AIOHTTP Static Resource Handler Information Exposure Vulnerability on Windows

A vulnerability exists in AIOHTTP versions prior to 3.13.4, specifically on Windows systems. The static resource handler may inadvertently reveal information about a remote NTLMv2 path. This exposure could potentially allow an attacker to extract NTLMv2 hashes and retrieve user credentials, especially if the application is using AIOHTTP's static resource handler in a production environment.

Impact

Exploitation of this vulnerability could lead to unauthorized access to NTLMv2 hashes, allowing for the extraction of user credentials.

Remediation

Users can upgrade to AIOHTTP version 3.13.4 or later to address this vulnerability.