CVE-2024-5550: Exposure of Sensitive Information via Arbitrary System Path Lookup in h2oai/h2o-3
In h2oai/h2o-3 version 3.40.0.4, an exposure of sensitive information vulnerability exists due to an arbitrary system path lookup feature. This vulnerability allows any remote user to view full paths in the entire file system where h2o-3 is hosted. Specifically, the issue resides in the Typeahead API call, which when requested with a typeahead lookup of '/', exposes the root filesystem including directories such as /home, /usr, /bin, among others. This vulnerability could allow attackers to explore the entire filesystem, and when combined with a Local File Inclusion (LFI) vulnerability, could make exploitation of the server trivial.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-5550?
CVE-2024-5550 is classified as a medium severity vulnerability due to the exposure of sensitive information.
How do I fix CVE-2024-5550?
To fix CVE-2024-5550, upgrade to a version of h2o-3 above 3.40.0.4 where this issue is resolved.
What software is affected by CVE-2024-5550?
CVE-2024-5550 affects h2o-3 version 3.40.0.4 and earlier versions installed via pip.
What is the impact of CVE-2024-5550?
The impact of CVE-2024-5550 allows remote users to view sensitive file system paths on the server hosting h2o-3.
When was CVE-2024-5550 disclosed?
CVE-2024-5550 was disclosed in 2024, specifically addressing vulnerabilities present in version 3.40.0.4.