CVE-2024-8616: Arbitrary File Overwrite in h2oai/h2o-3
In h2oai/h2o-3 version 3.46.0, the /99/Models/{name}/json endpoint allows for arbitrary file overwrite on the target server. The vulnerability arises from the exportModelDetails function in ModelsHandler.java, where the user-controllable mexport.dir parameter is used to specify the file path for writing model details. This can lead to overwriting files at arbitrary locations on the host system.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-8616?
CVE-2024-8616 has been rated as a high severity vulnerability due to its potential for arbitrary file overwrite.
How do I fix CVE-2024-8616?
To fix CVE-2024-8616, update to the latest version of h2o-3 where the vulnerability has been patched.
What is affected by CVE-2024-8616?
CVE-2024-8616 affects h2oai's h2o-3 version 3.46.0.
What kind of attack does CVE-2024-8616 facilitate?
CVE-2024-8616 facilitates arbitrary file overwrite attacks by misusing the exportModelDetails function.
How does CVE-2024-8616 affect server security?
CVE-2024-8616 can compromise server security by allowing attackers to overwrite files, potentially leading to data loss or unauthorized access.