CVE-2024-5550

Sensitive information exposure via arbitrary system path lookup in h2o-3.

• CVSS 5.3
• CWE-22
• Information Leakage
• Remote

In h2oai/h2o-3 version 3.40.0.4, an exposure of sensitive information vulnerability exists due to an arbitrary system path lookup feature. This vulnerability allows any remote user to view full paths in the entire file system where h2o-3 is hosted. Specifically, the issue resides in the Typeahead API call, which when requested with a typeahead lookup of '/', exposes the root filesystem including directories such as /home, /usr, /bin, among others. This vulnerability could allow attackers to explore the entire filesystem, and when combined with a Local File Inclusion (LFI) vulnerability, could make exploitation of the server trivial.

CVE

CVE-2024-5550

CWE

CWE-22

CVSS base score

5.3

Published

2024-06-06

OWASP

A03 Sensitive Data Exposure

Orthogonal defect classification

Interface

Code defect classification

Extraneous Functionality

Category

Information Leakage

Subcategory

Information Disclosure

Accessibility scope

Remote

Impact

Information Disclosure

Affected component

h2oai/h2o-3

Fixed by upgrading

Yes

Solution

Upgrade to h2oai/h2o-3 version 3.40.0.5 or later to mitigate the vulnerability.

from flask import Flask, request, jsonify
import os

app = Flask(__name__)

@app.route('/typeahead', methods=['GET'])
def typeahead():
    query = request.args.get('query', '')
    try:
        with open(os.path.join('/some/base/path', query), 'r') as f:
            data = f.read()
        return jsonify({"results": data})
    except Exception as e:
        return jsonify({"error": str(e)}), 400

if __name__ == '__main__':
    app.run()

from flask import Flask, request, jsonify
import os
import re

app = Flask(__name__)

@app.route('/typeahead', methods=['GET'])
def typeahead():
    query = request.args.get('query', '')

    if not re.match(r'^[a-zA-Z0-9_]+$', query):
        return jsonify({"error": "Invalid query parameter.  Only alphanumeric characters and underscores are allowed."}), 400

    base_path = '/some/base/path'

    filepath = os.path.join(base_path, query)

    if not filepath.startswith(base_path):
        return jsonify({"error": "Invalid query parameter.  Path traversal detected."}), 400

    try:
        with open(filepath, 'r') as f:
            data = f.read()
        return jsonify({"results": data})
    except FileNotFoundError:
        return jsonify({"error": "File not found"}), 404
    except Exception as e:
        print(f"Error reading file: {e}")
        return jsonify({"error": "An error occurred while processing your request."}), 500

if __name__ == '__main__':
    app.run()

curl       
http://localhost:5000/typeahead?query=../etc/passwd

@misc{vaitp:cve20245550,
  title        = {{Sensitive information exposure via arbitrary system path lookup in h2o-3.}},
  author       = {Bogaerts, Fr\'ed\'eric and Ivaki, Naghmeh and Fonseca, Jos\'e},
  year         = {2024},
  note         = {VAITP Python Vulnerability Dataset, entry CVE-2024-5550},
  howpublished = {\url{https://netpack.pt/vaitp/vulnerability/CVE-2024-5550/}}
}