GitHub Advisoryadvisory · PyPI

GHSA-x234-r5fg-x52m Arbitrary system path lookup in h20

MEDIUM Published 2024-06-06 Modified 2024-06-06 Official page ↗
Aliases
CVE-2024-5550
Ecosystem
PyPI
Packages
h2o
Severity
Moderate
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Weaknesses
CWE-200, CWE-22
Reviewed
2024-06-06

Affected packages

• PyPI h2o: <= 3.40.0.4 (no fix yet)

Description

In h2oai/h2o-3 version 3.40.0.4, an exposure of sensitive information vulnerability exists due to an arbitrary system path lookup feature. This vulnerability allows any remote user to view full paths in the entire file system where h2o-3 is hosted. Specifically, the issue resides in the Typeahead API call, which when requested with a typeahead lookup of '/', exposes the root filesystem including directories such as /home, /usr, /bin, among others. This vulnerability could allow attackers to explore the entire filesystem, and when combined with a Local File Inclusion (LFI) vulnerability, could make exploitation of the server trivial.

Related

Alias · CVE (1)

  • CVE-2024-5550 In h2oai/h2o-3 version 3.40.0.4, an exposure of sensitive information vulnerability exists due to an arbitrary system path lookup feature. vulnerability

Weakness · CWE (2)

  • CWE-200 Exposure of Sensitive Information to an Unauthorized Actor weakness
  • CWE-22 Improper Limitation of a Pathname to a Restricted Directory weakness

References