Encryption of Arbitrary Files with Attacker-Controlled Key in h2oai/h2o-3

Vulnerability

Analysis

CVE-2024-6863 affects H2O-3 version 3.46.0, an open-source machine learning platform [1]. The vulnerability lies in an endpoint that exposes a custom EncryptionTool. This design flaw allows an attacker with network access to the H2O-3 instance to encrypt arbitrary files on the target server [2][3]. The attacker can specify any encryption key of their choosing, and critically, can also overwrite the key, making true recovery of the original keys all but impossible [2].

Exploitation

An attacker exploiting this vulnerability requires network access to the exposed endpoint that provides the EncryptionTool functionality. There are no authentication prerequisites mentioned; the endpoint appears to be available without proper access controls. Once accessed, the attacker can call the EncryptionTool's methods to encrypt files on the server, and the chosen encryption key can be overwritten at will, thus preventing the victim from decrypting the files [2].

Impact

The impact is ransomware-like behavior: an attacker can encrypt arbitrary files on the H2O-3 server with keys they control. Because the key can be overwritten, the victim cannot rely on a previously set key for decryption. This can lead to complete loss of data availability, and potentially integrity, for files stored on the affected server [2].

Mitigation

At the time of this writing, the official H2O-3 GitHub repository does not indicate a patched version [1]. Users of H2O-3 3.46.0 should consider restricting network access to the vulnerable endpoint or disabling the EncryptionTool if not required. Monitoring for the release of a security update from H2O.ai is recommended [1][2].