Lokale Datei-Inklusion in Solara

The LFI vulnerability in Solara arises from inadequate validation of URI fragments used for serving static files. An attacker can craft a malicious URI containing directory traversal sequences (e.g., '../') to bypass intended access controls. Successful exploitation could allow an attacker to read sensitive configuration files, source code, or other data stored on the server's file system. The potential impact ranges from information disclosure to, in some cases, remote code execution if the attacker can leverage the read access to modify or execute files.

Organizations deploying Solara for web applications, particularly those serving sensitive data or running in environments with limited security controls, are at risk. Shared hosting environments where users have the ability to influence URI parameters are also particularly vulnerable.

• python / server:

# Check for vulnerable Solara versions
python -c "import solara; print(solara.__version__)"

• generic web:

# Check for URI fragment manipulation attempts in access logs
grep -i '..\/' /var/log/apache2/access.log

1. 2024-07-12Disclosure

   disclosure

1. Reserviert2024-07-02
2. Veröffentlicht2024-07-12
3. Geändert2024-08-02
4. EPSS aktualisiert2026-04-02

The primary mitigation for CVE-2024-39903 is to upgrade Solara to version 1.35.1 or later, which includes the necessary fixes for URI fragment validation. If upgrading immediately is not feasible, consider implementing a Web Application Firewall (WAF) rule to block requests containing directory traversal sequences in the URI fragment. Additionally, restrict access to static file directories and implement robust input validation to prevent malicious URI manipulation. After upgrading, confirm the fix by attempting to access a file outside the intended static file directory via a crafted URI; access should be denied.