CVE-2024-39903
📋 TL;DR
This Local File Inclusion vulnerability in Solara allows attackers to read arbitrary files on the server by manipulating URI fragments with directory traversal sequences like '../'. It affects all Solara deployments running versions before 1.35.1 that serve static files.
💻 Affected Systems
- widgetti/solara
📦 What is this software?
Solara by Widgetti
⚠️ Risk & Real-World Impact
Worst Case
Complete server compromise through reading sensitive files like SSH keys, configuration files with credentials, or database connection strings, potentially leading to lateral movement and data exfiltration.
Likely Case
Unauthorized access to sensitive application files, configuration data, or user data stored on the server filesystem.
If Mitigated
Limited impact with proper file permissions and network segmentation, though sensitive files could still be exposed if accessible to the application user.
🎯 Exploit Status
Exploitation requires only HTTP requests with crafted URI fragments. No authentication or special privileges needed.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.35.1
Vendor Advisory: https://github.com/widgetti/solara/security/advisories/GHSA-9794-pc4r-438w
Restart Required: Yes
Instructions:
1. Update Solara: pip install --upgrade solara==1.35.1
2. Restart all Solara applications and services
3. Verify the version with: python -c "import solara; print(solara.__version__)"
🔧 Temporary Workarounds
Disable static file serving
allIf static file serving is not required, disable it in Solara configuration
Configure Solara to not serve static files through application settings
Web server proxy filtering
allConfigure reverse proxy (nginx, Apache) to filter or block requests with '../' sequences
Add location block in nginx: location ~ \.\./ { deny all; }
Add Apache rule: RewriteRule .*\.\./.* - [F]
🧯 If You Can't Patch
- Implement strict file system permissions to limit what files the Solara process user can read
- Deploy network segmentation to isolate Solara instances from sensitive systems and data
🔍 How to Verify
Check if Vulnerable:
Check Solara version: python -c "import solara; print(solara.__version__)" - if version < 1.35.1, system is vulnerableCheck Version:
python -c "import solara; print(solara.__version__)"Verify Fix Applied:
After patching, test with a controlled request containing '../' in URI fragment to ensure it's blocked📡 Detection & Monitoring
Log Indicators:
- HTTP requests with '../' sequences in URI fragments
- Multiple failed file access attempts from single IP
Network Indicators:
- HTTP GET requests with unusual fragment patterns
- Rapid sequential requests for different file paths
SIEM Query:
source="web_server" AND (uri_fragment="*../*" OR uri_fragment="*..\\*" OR uri_fragment="*%2e%2e%2f*")🔗 References
- https://github.com/widgetti/solara/commit/df2fd66a7f4e8ffd36e8678697a8a4f76760dc54
- https://github.com/widgetti/solara/security/advisories/GHSA-9794-pc4r-438w
- https://github.com/widgetti/solara/commit/df2fd66a7f4e8ffd36e8678697a8a4f76760dc54
- https://github.com/widgetti/solara/security/advisories/GHSA-9794-pc4r-438w
