github.com
https://github.com/h2oai/h2o-3 CVE-2023-6038
HIGHNuclei
Local File Inclusion in h2oai/h2o-3
Record summary
CVE-2023-6038 has a selected CVSS score of 7.5 (high); EIP currently links 1 Nuclei template.
Description
A Local File Inclusion (LFI) vulnerability exists in the h2o-3 REST API, allowing unauthenticated remote attackers to read arbitrary files on the server with the permissions of the user running the h2o-3 instance. This issue affects the default installation and does not require user interaction. The vulnerability can be exploited by making specific GET or POST requests to the ImportFiles and ParseSetup endpoints, respectively. This issue was identified in version 3.40.0.4 of h2o-3.
Description source: CVE List
Exploitation context
Known exploitation
- VulnCheck KEV
- Listed · Jan 22, 2024 · VulnCheck
- Reported exploitation
- Observed · VulnCheck
Available material
- Nuclei templates
- 1
CISA SSVC decision
ExploitationPoC
AutomatableYes
Technical impactPartial
CISA Coordinator · SSVC 2.0.3 · Evaluated Aug 29, 2024 · Source: CVE List
Affected products and versions
3| Product | Source | Version range | Status |
|---|---|---|---|
| VulnCheck | Version data not supplied | ||
h2oai/h2o-3Browse h2oai / h2oai/h2o-3 | CVE List | Through latest | affected |
ai.h2o:h2o-coreBrowse Maven / ai.h2o:h2o-core | GitHub Advisory | Through 3.40.0.4 | affected |
Nuclei templates
1ProjectDiscoveryHIGHH2O ImportFiles - Local File InclusionCVSS 7.5
An attacker is able to read any file on the server hosting the H2O dashboard without any authentication.
Impact
Unauthenticated attackers can read any file on the server via the ImportFiles endpoint, potentially exposing sensitive data including database contents and application code.
Remediation
Update H2O to a version that implements proper authentication and authorization controls for the ImportFiles endpoint.
WeaknessesCWE-862
Authorsdanmcinerney, byt3bl33d3r
Template tagscvecve2023h2o-3h2omlvkevvuln
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CPE: cpe:2.3:a:h2o:h2o:-:*:*:*:*:*:*:*
Shodan: title:"H2O Flow"
Shodan: http.title:"h2o flow"
FOFA: title="h2o flow"
Google: intitle:"h2o flow"
https://huntr.com/bounties/380fce33-fec5-49d9-a101-12c972125d8c/ https://nvd.nist.gov/vuln/detail/CVE-2023-6038 https://github.com/h2o/h2o
Source: ProjectDiscovery
References
3huntr.com
https://huntr.com/bounties/380fce33-fec5-49d9-a101-12c972125d8c nvd.nist.gov
https://nvd.nist.gov/vuln/detail/CVE-2023-6038