PT-2025-12190 · H2O.Ai · H2O-3

Published 2025-03-20 · Updated 2025-03-20 · CVE-2024-7768

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions h2oai/h2o-3 version 3.46.1

Description A vulnerability in the "/3/ImportFiles" endpoint allows an attacker to cause a denial of service. The endpoint takes a single GET parameter, path, which can be recursively set to reference itself, leading the server to repeatedly call its own endpoint and eventually filling up the request queue, leaving the server unable to handle other requests.

Recommendations For version 3.46.1, as a temporary workaround, consider restricting access to the "/3/ImportFiles" endpoint until a patch is available. Avoid using the path parameter in the affected endpoint to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

DoS

Allocation of Resources Without Limits

Resource Exhaustion

Weakness Enumeration

CWE-770

CWE-400

Related Identifiers

CVE-2024-7768

GHSA-P2VC-M5FV-9W9M

Affected Products

H2O-3

References · 7

• 🔥 https://huntr.com/bounties/3fe640df-bef4-4072-8890-0d12bc2818f6 · Exploit
• https://osv.dev/vulnerability/GHSA-p2vc-m5fv-9w9m · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-7768 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-7768 · Security Note
• https://github.com/h2oai/h2o-3 · Note
• https://github.com/h2oai/h2o-3/blob/7d418fa19d3ab434f742818e37f891bef9102c97/h2o-core/src/main/java/water/api/ImportFilesHandler.java#L19 · Note
• https://twitter.com/CVEnew/status/1902671066712981862 · Twitter Post