Local File Inclusion in h2oai/h2o-3

Vulnerability

Overview

CVE-2023-6038 describes a Local File Inclusion (LFI) vulnerability in the H2O-3 REST API. The root cause lies in insufficient input validation when handling file paths in the ImportFiles and ParseSetup endpoints. An unauthenticated attacker can manipulate parameters in GET or POST requests to these endpoints to include arbitrary files from the server's filesystem [1][2].

Exploitation

The attack surface is the REST API exposed by a default installation of H2O-3 version 3.40.0.4. No authentication or user interaction is required; a remote attacker simply sends crafted requests to the vulnerable endpoints. The vulnerability is available without any special configuration beyond the default deployment [2][3].

Impact

Successful exploitation allows the attacker to read any file on the server that the H2O-3 process has permission to access. This could expose sensitive configuration files, credentials, source code, or data loaded into the H2O-3 instance, leading to information disclosure and potentially further compromise of the environment [2][3].

Mitigation

As of the publication date, the vulnerability was identified in H2O-3 version 3.40.0.4. Users should update to a patched version as soon as it becomes available. No workaround is documented; restricting network access to the REST API may reduce risk but does not eliminate the vulnerability [2][3].