Exposure of Sensitive Information via Arbitrary System Path Lookup in h2oai/h2o-3

Vulnerability

Overview

CVE-2024-5550 is an information disclosure vulnerability in h2oai/h2o-3 version 3.40.0.4. The root cause is an arbitrary system path lookup feature in the Typeahead API endpoint [1][2]. When a remote user sends a typeahead lookup request with the value '/', the API returns the root filesystem listing, including directories such as /home, /usr, /bin, and others. The API performs no authentication or authorization checks, making the vulnerability exploitable from the network without any prior access [2].

Exploitation

An attacker can exploit this vulnerability by crafting a simple HTTP request to the Typeahead API endpoint with a payload of '/'. The server responds with a directory listing of the root filesystem, revealing the full path structure of the host system. No special privileges or prior knowledge is required – any remote user can trigger the disclosure [2]. The vulnerability is trivially exploitable and can be automated.

Impact

The immediate impact is the exposure of sensitive system information, such as directory paths and file system layout, which helps an attacker map the server's environment. More critically, the advisory notes that this information disclosure can be combined with a Local File Inclusion (LFI) vulnerability to achieve full server compromise [2]. By knowing the exact file paths, an attacker could construct LFI payloads to read arbitrary files, potentially including configuration files, credentials, or application source code.

Mitigation

At the time of publication, no patch has been released for CVE-2024-5550. The vulnerability affects H2O-3 version 3.40.0.4. Users should monitor the official H2O-3 GitHub repository [1] for version updates. As a workaround, administrators can restrict network access to the Typeahead API endpoint using firewall rules or a reverse proxy, ensuring only trusted clients can reach the vulnerable endpoint.