CVE-2024-39903: Local File Inclusion in Solara

July 12, 2024

A Local File Inclusion (LFI) vulnerability was identified in widgetti/solara, in version <1.35.1, which was fixed in version 1.35.1. This vulnerability arises from the application’s failure to properly validate URI fragments for directory traversal sequences such as ‘../’ when serving static files. An attacker can exploit this flaw by manipulating the fragment part of the URI to read arbitrary files on the local file system.

References

github.com/advisories/GHSA-9794-pc4r-438w
github.com/widgetti/solara
github.com/widgetti/solara/commit/df2fd66a7f4e8ffd36e8678697a8a4f76760dc54
github.com/widgetti/solara/security/advisories/GHSA-9794-pc4r-438w
nvd.nist.gov/vuln/detail/CVE-2024-39903

Code Behaviors & Features

Detect and mitigate CVE-2024-39903 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →