CVE-2023-6038
Published: 16 November 2023
Summary
CVE-2023-6038 is a high-severity Missing Authorization (CWE-862) vulnerability in H2O H2O. Its CVSS base score is 7.5 (High).
Operationally, ranked in the top 1.6% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Deeper analysis
A Local File Inclusion vulnerability tracked as CVE-2023-6038 affects the REST API in h2o-3 version 3.40.0.4. Unauthenticated remote attackers can read arbitrary files on the server by sending crafted GET requests to the ImportFiles endpoint or POST requests to the ParseSetup endpoint, with access limited only by the privileges of the process running the h2o-3 instance. The flaw stems from missing authorization checks (CWE-862) and is present in the default installation without requiring user interaction, resulting in a CVSS 3.1 score of 7.5 focused on high confidentiality impact.
Attackers with network access to the h2o-3 instance can exploit the endpoints directly to retrieve sensitive files such as configuration data or credentials stored on the host. Because the vulnerability requires no authentication or special privileges, it can be triggered from any remote system able to reach the API.
The provided references consist of duplicate links to a huntr.dev bounty report that describes the issue; no vendor advisory, patch details, or mitigation guidance appear in the supplied information. The associated EPSS score has remained stable at its recorded peak of 0.6328.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2023-2900
Vulnerability details
A Local File Inclusion (LFI) vulnerability exists in the h2o-3 REST API, allowing unauthenticated remote attackers to read arbitrary files on the server with the permissions of the user running the h2o-3 instance. This issue affects the default installation and…
more
does not require user interaction. The vulnerability can be exploited by making specific GET or POST requests to the ImportFiles and ParseSetup endpoints, respectively. This issue was identified in version 3.40.0.4 of h2o-3.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Requiring an access control policy ensures authorization checks are defined and applied for critical functions.
Reviews of access controls detect missing authorization checks on critical functions or resources.
Documenting permitted unauthenticated actions prevents missing authorization by making all exceptions explicit and subject to organizational review.
Requiring attribute association with information prevents authorization from being performed without necessary security or privacy context.
Mandating authorization prior to allowing remote connections addresses missing authorization for remote access.
Mandating authorization before wireless connections are allowed prevents missing authorization for wireless access.
The control requires authorization before allowing mobile device connections, directly mitigating missing authorization for system access.
Requiring approvals for account creation and specifying authorizations ensures authorization is not missing for system access.