GHSA-g48v-3p35-88jr
H2O Vulnerable to Arbitrary File Overwrite
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| PyPI | h2o | >= 3.10.4.1, <= 3.46.0 | no fix listed |
| Maven | ai.h2o:h2o-core | >= 3.10.4.1, <= 3.46.0 | no fix listed |
Details
As written in the advisory (Markdown source, shown as plain text).
In h2oai/h2o-3 version 3.46.0, the `/99/Models/{name}/json` endpoint allows for arbitrary file overwrite on the target server. The vulnerability arises from the `exportModelDetails` function in `ModelsHandler.java`, where the user-controllable `mexport.dir` parameter is used to specify the file path for writing model details. This can lead to overwriting files at arbitrary locations on the host system.
References
External links from the advisory. They lead to third-party sites.