CVE-2024-5986: H2O Package Arbitrary File Write Vulnerability
Summary
CVE-2024-5986: H2O has an External Control of File Name or Path vulnerability. Affects ai.h2o:h2o-core versions < 3.46.0.1. No fix is published. How to fix ↓
Also tracked for
- h2o · PyPI
The same CVE-2024-5986 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
H2O is an open-source platform designed for data analysis and machine learning. It provides a suite of tools for data scientists and developers to build and deploy machine learning models efficiently. The package is widely used for its scalability and performance in handling large datasets. However, a critical vulnerability has been identified in version 3.46.0.1, which allows remote attackers to exploit the system.
Vulnerability Detail
A vulnerability in h2oai/h2o-3 version 3.46.0.1 allows remote attackers to write arbitrary data to any file on the server. This is achieved by exploiting the '/3/Parse' endpoint to inject attacker-controlled data as the header of an empty file, which is then exported using the '/3/Frames/framename/export' endpoint. The impact of this vulnerability includes the potential for remote code execution and complete access to the system running h2o-3, as attackers can overwrite critical files such as private SSH keys or script files.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, restrict access to the '/3/Parse' and '/3/Frames/framename/export' endpoints to trusted users only. Implementing network-level controls or API gateways can help mitigate unauthorized access.
Conclusion
The H2O package has a critical vulnerability (CVE-2024-5986) that allows remote attackers to write arbitrary data to server files. It is crucial to update to the patched version (3.46.0.2) to protect against potential exploits. Utilizing tools like Vulert can help monitor for such vulnerabilities in real-time.
See every vulnerability recorded for ai.h2o:h2o-core →
FAQ
CVE-2024-5986 is a critical vulnerability in the H2O package that allows remote attackers to write arbitrary data to files on the server.
You can check if your application is affected by using Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Visit Vulert Scanner to use the Vulert playground.
The vulnerability can lead to remote code execution and complete access to the system, allowing attackers to overwrite critical files.
Yes, a patched version (3.46.0.2) is available. It is recommended to update to this version to mitigate the vulnerability.
The CVSS score for this vulnerability is 9.1, indicating a critical level of severity.
References
Related vulnerabilities
Recent vulnerabilities recorded for ai.h2o:h2o-core.
