H2O-3 Arbitrary File Overwrite (CVE-2024-6854)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(213042);
  script_version("1.4");
  script_set_attribute(attribute:"plugin_modification_date", value:"2025/07/16");

  script_cve_id("CVE-2024-6854");

  script_name(english:"H2O-3 Arbitrary File Overwrite (CVE-2024-6854)");

  script_set_attribute(attribute:"synopsis", value:
"A Python library installed on the remote host is affected by a vulnerability.");
  script_set_attribute(attribute:"description", value:
"An arbitrary file overwrite vulnerability exists in H2O-3. The endpoint that allows 
for exporting models & does not limit where models can be exported to. As such an 
attacker can export a model to any file in the server file structure, overwriting it, 
by simply using the force flag.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version
number.");
  # https://huntr.com/bounties/97d013f9-ac51-4c80-8dd7-8dfde11f33b2
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?38d3453f");
  # https://github.com/h2oai/h2o-3/blob/master/h2o-core/src/main/java/hex/Model.java#L3366
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?af873332");
  script_set_attribute(attribute:"solution", value:
"This vulnerability is currently not fixed. Fix the code manually or monitor new releases for a fix.");
  script_set_attribute(attribute:"agent", value:"all");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:POC/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:P/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2024-6854");

  script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"true");
  script_set_attribute(attribute:"vendor_unpatched", value:"true");

  script_set_attribute(attribute:"vuln_publication_date", value:"2024/07/17");
  script_set_attribute(attribute:"plugin_publication_date", value:"2024/12/16");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"asset_categories", value:"component");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:h2o:h2o:3");
  script_set_attribute(attribute:"thorough_tests", value:"true");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Artificial Intelligence");

  script_copyright(english:"This script is Copyright (C) 2024-2025 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("python_h2o3_detect.nasl");
  script_require_ports("installed_sw/H2O");

  exit(0);
}

include('vcf.inc');

var app_name = 'H2O';
var app_info = vcf::get_app_info(app:app_name);

report = 'This vulnerability remains unfixed and exists in the following locations:\n';

report += '\t Path: ' + app_info.path;
security_report_v4(port:0, severity:SECURITY_HOLE, extra:report);