CVE-2023-6038 Local File Inclusion in h2oai/h2o-3

Critical 9.3 Published 16 Nov 2023 Updated 29 Aug 2024

Unauthenticated attackers can read arbitrary files on the server via Local File Inclusion in the h2o-3 REST API.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2023-6038?

CVE-2023-6038 is a critical path traversal vulnerability in h2oai/h2o-3, published on 16 Nov 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

A Local File Inclusion (LFI) vulnerability exists in the h2o-3 REST API, allowing unauthenticated remote attackers to read arbitrary files on the server with the permissions of the user running the h2o-3 instance. This issue affects the default installation and does not require user interaction. The vulnerability can be exploited by making specific GET or POST requests to the ImportFiles and ParseSetup endpoints, respectively. This issue was identified in version 3.40.0.4 of h2o-3.

Weakness: CWE-862

Which versions are affected by CVE-2023-6038?

2 open source packages ship an affected version, including ai.h2o:h2o-core. It affects 1 product.

Package	Affected	Fixed in
`ai.h2o:h2o-core` Maven	All versions to `3.40.0.4`	None
`ai.h2o:h2o-core` Maven	All versions to `3.40.0.4`	None

Products include H2o H2o.

How do I fix CVE-2023-6038?

No fix has been published for CVE-2023-6038 yet. Limit exposure of the affected software until one is available.

Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.

Is CVE-2023-6038 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2023-6038 exists.

Public exploit code: 1 Nuclei template.

Sources

Also known as GHSA-6mv8-95x5-xcq9.