CVE-2025-46096: 
Java vulnerability analysis and mitigation

CVE-2025-46096 is a Directory Traversal vulnerability in the solon-faas-luffy component of the Solon Java framework (by noear) that allows a remote attacker to load and execute arbitrary JavaScript files from outside the intended directory, which can be leveraged to conduct Cross-Site Scripting (XSS) attacks. It affects Solon versions >= 3.1.2 and < 3.2.0, with version 3.2.0 being the patched release. The vulnerability was disclosed on June 13, 2025, and carries a CVSS v3.1 base score of 6.1 (Medium) (Github Advisory, Solon Issue).

The root cause is improper path validation in org.noear.solon.luffy.impl.JtFunctionLoaderFile, specifically in the fileGet and fileBuildDo methods (CWE-22: Path Traversal; CWE-79: Cross-Site Scripting). When a request is processed by LuffyHandler, the path parameter is not sanitized for ../ sequences, allowing an attacker to traverse the file system and load arbitrary .js files from any directory accessible to the server process. Because the loaded JavaScript is executed server-side via the Solon FaaS runtime (which can invoke java.lang.Runtime), and the response may be reflected to users, this also enables XSS attacks. Exploitation requires no authentication but does require user interaction (e.g., a victim visiting a crafted URL) (Solon Issue, Github Advisory).

Successful exploitation allows an attacker to traverse the server's directory structure and load arbitrary JavaScript files for execution within the Solon FaaS runtime, potentially enabling arbitrary OS command execution (e.g., via java.lang.Runtime.getRuntime().exec()). Additionally, the vulnerability can be used to conduct XSS attacks against users of the affected application, risking session hijacking, credential theft, and web page content manipulation. Availability is not directly impacted, but confidentiality and integrity are both at risk (Github Advisory, Solon Issue).

A proof-of-concept exploit is publicly available via a GitHub Gist and the original issue report, demonstrating path traversal to load and execute arbitrary JavaScript (Solon Issue, PoC Gist). There is no current evidence of in-the-wild exploitation, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.087%–0.323%, placing it in the 56th percentile for exploitation probability within 30 days (Github Advisory).

1. Reconnaissance: Identify internet-facing applications using the Solon framework with the solon-faas-luffy component (version >= 3.1.2, < 3.2.0) by examining HTTP response headers, error pages, or dependency manifests.
2. Prepare malicious JavaScript: Place a malicious .js file in a world-readable directory on the target server (e.g., /tmp/poc.js) containing a payload such as var a=java.lang.Runtime.getRuntime().exec("<command>");.
3. Craft traversal request: Send an HTTP GET request with path traversal sequences to escape the FaaS base directory and reference the malicious file:

   GET /../../../../../../../../../tmp/poc.js HTTP/1.1
   Host: <target>:8080

4. Trigger execution: The JtFunctionLoaderFile handler resolves the traversed path without sanitization, loads the attacker-controlled .js file, and executes it within the Solon FaaS runtime.
5. XSS delivery (optional): Craft a URL pointing to a traversed path that returns JavaScript content reflected to a victim's browser, enabling XSS attacks such as session token theft or page manipulation (Solon Issue, PoC Gist).

• Network: HTTP GET requests to the application containing ../ or URL-encoded equivalents (%2e%2e%2f, ..%2f) in the path, particularly targeting the FaaS endpoint (e.g., GET /../../../../../../../../../tmp/poc.js).
• Logs: Application access logs showing requests with path traversal sequences (..) in the URI path; unexpected file paths being accessed outside the FaaS base directory in server logs.
• File System: Unexpected .js files in world-readable directories (e.g., /tmp/) containing Java runtime invocations or shell commands; new files created by the application server process in unusual locations.
• Process: Unusual child processes spawned by the Java/Solon server process (e.g., calc, bash, curl, wget) indicating successful JavaScript-based OS command execution (Solon Issue).

Upgrade the solon-faas-luffy Maven package (org.noear:solon-faas-luffy) to version 3.2.0 or later, which includes a fix for path traversal detection (commit 49a3bf9) (Github Advisory). As a temporary workaround, restrict network access to the FaaS endpoint, implement a web application firewall (WAF) rule to block requests containing ../ sequences, and ensure the application server process runs with least-privilege file system permissions to limit the impact of traversal. Input validation and sanitization should be enforced at the application layer for all path parameters.