CVE-2024-1456

S3 Bucket Takeover in h2oai/h2o-3

An S3 bucket takeover vulnerability was identified in the h2oai/h2o-3 repository. The issue involves the S3 bucket 'http://s3.amazonaws.com/h2o-training', which was found to be vulnerable to unauthorized takeover.

CVSS 3.0 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

H2o H2oai

Products

H2o H2o-3

CVE-2024-6854

Arbitrary File Overwrite in h2oai/h2o-3

In h2oai/h2o-3 version 3.46.0, the endpoint for exporting models does not restrict the export location, allowing an attacker to export a model to any file in the server's file structure, thereby overwriting it. This vulnerability can be exploited to overwrite any file on the target server with a trained model file, although the content of the overwrite is not controllable by the attacker.

CVSS 3.0 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

H2o

Products

H2o

CVE-2024-8616

Arbitrary File Overwrite in h2oai/h2o-3

In h2oai/h2o-3 version 3.46.0, the `/99/Models/{name}/json` endpoint allows for arbitrary file overwrite on the target server. The vulnerability arises from the `exportModelDetails` function in `ModelsHandler.java`, where the user-controllable `mexport.dir` parameter is used to specify the file path for writing model details. This can lead to overwriting files at arbitrary locations on the host system.

CVSS 3.0 · 8.2 High EPSS < 1% KEV · Not listed

Vendors

H2o

Products

H2o

CVE-2024-10550

Denial of Service by ReDOS in h2oai/h2o-3

A vulnerability in the `/3/ParseSetup` endpoint of h2oai/h2o-3 version 3.46.0.1 allows for a denial of service (DoS) attack. The endpoint applies a user-specified regular expression to a user-controllable string. This can be exploited by an attacker to cause inefficient regular expression complexity, leading to the exhaustion of server resources and making the server unresponsive.

CVSS 3.0 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

H2o

Products

H2o

CVE-2024-10553

Jdbc Deserialization in h2oai/h2o-3

A vulnerability in the h2oai/h2o-3 REST API versions 3.46.0.4 allows unauthenticated remote attackers to execute arbitrary code via deserialization of untrusted data. The vulnerability exists in the endpoints POST /99/ImportSQLTable and POST /3/SaveToHiveTable, where user-controlled JDBC URLs are passed to DriverManager.getConnection, leading to deserialization if a MySQL or PostgreSQL driver is available in the classpath. This issue is fixed in version 3.47.0.

CVSS 3.0 · 9.8 Critical EPSS 1.6% KEV · Not listed

Vendors

H2o H2oai

Products

H2o H2o-3

CVE-2023-6569

External Control of File Name or Path in h2oai/h2o-3

External Control of File Name or Path in h2oai/h2o-3

CVSS 3.1 · 8.2 High EPSS < 1% KEV · Not listed

Vendors

H2o

Products

H2o

CVE-2024-7765

Denial of Service in h2oai/h2o-3

In h2oai/h2o-3 version 3.46.0.2, a vulnerability exists where uploading and repeatedly parsing a large GZIP file can cause a denial of service. The server becomes unresponsive due to memory exhaustion and a large number of concurrent slow-running jobs. This issue arises from the improper handling of highly compressed data, leading to significant data amplification.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

H2o

Products

H2o

CVE-2024-8062

Denial of Service in h2oai/h2o-3

A vulnerability in the typeahead endpoint of h2oai/h2o-3 version 3.46.0 allows for a denial of service. The endpoint performs a `HEAD` request to verify the existence of a specified resource without setting a timeout. An attacker can exploit this by sending multiple requests to an attacker-controlled server that hangs, causing the application to block and become unresponsive to other requests.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

H2o

Products

H2o

CVE-2023-6013

H2O Local File Include

H2O is vulnerable to stored XSS vulnerability which can lead to a Local File Include attack.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed

Vendors

H2o

Products

H2o

CVE-2023-6038

Local File Inclusion in h2oai/h2o-3

A Local File Inclusion (LFI) vulnerability exists in the h2o-3 REST API, allowing unauthenticated remote attackers to read arbitrary files on the server with the permissions of the user running the h2o-3 instance. This issue affects the default installation and does not require user interaction. The vulnerability can be exploited by making specific GET or POST requests to the ImportFiles and ParseSetup endpoints, respectively. This issue was identified in version 3.40.0.4 of h2o-3.

CVSS 3.1 · 7.5 High EPSS 4.3% KEV · Not listed

Vendors

H2o

Products

H2o

CVE-2023-6017

H2O S3 Bucket Takeover

H2O included a reference to an S3 bucket that no longer existed allowing an attacker to take over the S3 bucket URL.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

H2o

Products

H2o

CVE-2023-6016

H2O Remote Code Execution via POJO Model Import

An attacker is able to gain remote code execution on a server hosting the H2O dashboard through it's POJO model import feature.

CVSS 3.1 · 9.8 Critical EPSS 30.6% KEV · Not listed

Vendors

H2o

Products

H2o

CVE-2024-8862

h2oai h2o-3 JDBC Connection 1 getConnectionSafe deserialization

A vulnerability, which was classified as critical, has been found in h2oai h2o-3 3.46.0.4. This issue affects the function getConnectionSafe of the file /dtale/chart-data/1 of the component JDBC Connection Handler. The manipulation of the argument query leads to deserialization. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

CVSS 4.0 · 6.9 Medium EPSS 1.3% KEV · Not listed

Vendors

H2o H2oai

Products

H2o H2o-3