CVE-2024-39903

Local File Inclusion vulnerability in Solara due to improper URI validation.

• CVSS 7.5
• CWE-22
• Input Validation and Sanitization
• Remote

Solara is a pure Python, React-style framework for scaling Jupyter and web apps. A Local File Inclusion (LFI) vulnerability was identified in widgetti/solara, in version <1.35.1, which was fixed in version 1.35.1. This vulnerability arises from the application's failure to properly validate URI fragments for directory traversal sequences such as '../' when serving static files. An attacker can exploit this flaw by manipulating the fragment part of the URI to read arbitrary files on the local file system.

CVE

CVE-2024-39903

CWE

CWE-22

CVSS base score

7.5

Published

2024-07-12

OWASP

A05 Security Misconfiguration

Orthogonal defect classification

Checking

Code defect classification

Incorrect Check

Category

Input Validation and Sanitization

Subcategory

Local File Inclusion (LFI)

Accessibility scope

Remote

Impact

Information Disclosure

Affected component

widgetti/sol

Fixed by upgrading

Yes

Solution

Upgrade to version 1.35.1 or later.

def calculate(expression):
    """Calculate expression - VULNERABLE to code injection"""
    # VULNERABILITY: eval() executes arbitrary Python code
    return eval(expression)

# Example exploitation:
# calculate("__import__('os').system('whoami')")

import ast
import operator

def calculate_secure(expression):
    """Securely calculate mathematical expression"""
    try:
        # Parse expression into AST
        tree = ast.parse(expression, mode='eval')
        return eval_ast_node(tree.body)
    except:
        return None

def eval_ast_node(node):
    """Safely evaluate AST node"""
    if isinstance(node, ast.Constant):
        return node.value
    elif isinstance(node, ast.BinOp):
        left = eval_ast_node(node.left)
        right = eval_ast_node(node.right)
        ops = {ast.Add: operator.add, ast.Sub: operator.sub}
        return ops[type(node.op)](left, right)
    else:
        raise ValueError("Unsupported operation")

/files/../../etc/passwd

@misc{vaitp:cve202439903,
  title        = {{Local File Inclusion vulnerability in Solara due to improper URI validation.}},
  author       = {Bogaerts, Fr\'ed\'eric and Ivaki, Naghmeh and Fonseca, Jos\'e},
  year         = {2024},
  note         = {VAITP Python Vulnerability Dataset, entry CVE-2024-39903},
  howpublished = {\url{https://netpack.pt/vaitp/vulnerability/CVE-2024-39903/}}
}