PT-2023-32489 · H2O-3 · H2O-3

Published 2023-11-16 · Updated 2024-04-16 · CVE-2023-6038

Positive Technologies (AI Summary)

CVSS v3.1

9.3

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N

Name of the Vulnerable Software and Affected Versions h2o-3 version 3.40.0.4

Description A Local File Inclusion (LFI) issue exists in the h2o-3 REST API, allowing unauthenticated remote attackers to read arbitrary files on the server with the permissions of the user running the h2o-3 instance. This issue affects the default installation and does not require user interaction. The issue can be exploited by making specific GET or POST requests to the "ImportFiles" and "ParseSetup" endpoints, respectively.

Recommendations For version 3.40.0.4, as a temporary workaround, consider restricting access to the "ImportFiles" and "ParseSetup" endpoints until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Missing Authorization

Weakness Enumeration

CWE-862

CWE-29

Related Identifiers

CVE-2023-6038

GHSA-6MV8-95X5-XCQ9

Affected Products

H2O-3

References · 7

• 🔥 https://huntr.com/bounties/380fce33-fec5-49d9-a101-12c972125d8c · Exploit
• https://osv.dev/vulnerability/GHSA-6mv8-95x5-xcq9 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-6038 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-6038 · Security Note
• https://github.com/h2oai/h2o-3 · Note
• https://t.me/cvenotify/61129 · Telegram Post
• https://t.me/cvenotify/76910 · Telegram Post