In h2oai/h2o-3 version 3.40.0.4, an exposure of sensitive information vulnerability exists due to an arbitrary system path lookup feature. This vulnerability allows any remote user to view full paths in the entire file system where h2o-3 is hosted. Specifically, the issue resides in the Typeahead API call, which when requested with a typeahead lookup of '/', exposes the root filesystem including directories such as /home, /usr, /bin, among others. This vulnerability could allow attackers to explore the entire filesystem, and when combined with a Local File Inclusion (LFI) vulnerability, could make exploitation of the server trivial.
References
| Link | Resource |
|---|---|
| https://huntr.com/bounties/e76372c2-39be-4984-a7c8-7048a75a25dc | Exploit Third Party Advisory |
| https://huntr.com/bounties/e76372c2-39be-4984-a7c8-7048a75a25dc | Exploit Third Party Advisory |
Configurations
History
12 Feb 2025, 17:31
| Type | Values Removed | Values Added |
|---|---|---|
| CPE | cpe:2.3:a:h2o:h2o:3.40.0.4:*:*:*:*:*:*:* |
17 Oct 2024, 14:12
| Type | Values Removed | Values Added |
|---|---|---|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 5.3 |
| First Time |
H2o
H2o h2o |
|
| CWE | NVD-CWE-noinfo | |
| References | () https://huntr.com/bounties/e76372c2-39be-4984-a7c8-7048a75a25dc - Exploit, Third Party Advisory | |
| CPE | cpe:2.3:a:h2o:h2o:3.40.0.4:*:*:*:*:python:*:* |
06 Jun 2024, 19:16
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2024-06-06 19:16
Updated : 2025-02-12 17:31
NVD link : CVE-2024-5550
Mitre link : CVE-2024-5550
JSON object : View
Products Affected
h2o
- h2o
CWE