CVE-2024-39903: LFI in Solara Web Framework

The LFI vulnerability in Solara arises from inadequate validation of URI fragments used for serving static files. An attacker can craft a malicious URI containing directory traversal sequences (e.g., '../') to bypass intended access controls. Successful exploitation could allow an attacker to read sensitive configuration files, source code, or other data stored on the server's file system. The potential impact ranges from information disclosure to, in some cases, remote code execution if the attacker can leverage the read access to modify or execute files.

1. Reserved2024-07-02
2. Published2024-07-12
3. Modified2024-08-02
4. EPSS updated2026-04-02

The primary mitigation for CVE-2024-39903 is to upgrade Solara to version 1.35.1 or later, which includes the necessary fixes for URI fragment validation. If upgrading immediately is not feasible, consider implementing a Web Application Firewall (WAF) rule to block requests containing directory traversal sequences in the URI fragment. Additionally, restrict access to static file directories and implement robust input validation to prevent malicious URI manipulation. After upgrading, confirm the fix by attempting to access a file outside the intended static file directory via a crafted URI; access should be denied.