Arbitrary File Overwrite in h2oai/h2o-3

Vulnerability

Description

The H2O-3 machine learning platform, version 3.46.0, contains a vulnerability in its model export endpoint. The endpoint does not restrict or validate the file path provided by the user, allowing an attacker to specify an arbitrary path on the server's filesystem [1][2]. This means that when exporting a model, the attacker can direct the output to any location, including system or application files, effectively overwriting them with the contents of a trained model [2].

Exploitation

Prerequisites

An attacker must have access to the model export functionality, which typically requires authentication or network access to the H2O-3 instance [2]. The attacker also needs to have a trained model available to export; however, the model's exact content is irrelevant because the overwrite payload is the model file itself [2][4]. No further user interaction or additional privileges are required after gaining access to the endpoint [2].

Impact

The impact is a denial of service or server compromise via file overwrite. By overwriting critical files (such as application configuration, binaries, or startup scripts) with a model file, an attacker can disrupt normal operations, cause the server to fail, or potentially gain further control depending on the context [2][4]. It is important to note that the content of the overwriting model file is not attacker-controlled beyond the model's own binary format, so precise targeted manipulation of file content is not possible [2][4].

Mitigation

As of the publication date (2025-03-20), the vulnerability is unpatched in the affected version [2][4]. Users should restrict network access to the H2O-3 model export endpoint, monitor for suspicious export requests, and consider implementing a reverse proxy with path validation as a workaround [4]. H2O.ai has not yet released a security update addressing this issue.