CVE-2024-5986 — H2O-3 Arbitrary File Write Leading to Full Server Compromise
- CVE ID: CVE-2024-5986
- Affected Product: H2O-3 (machine learning platform by H2O.ai)
- Affected Version: 3.46.0.1 (and builds prior to the official fix)
- Vulnerability Type: Arbitrary File Write
- CVSS v3.x Score: 9.1
- Severity: Critical
- Attack Vector: Network (remote)
- Privileges Required: None
- User Interaction: None
- Impact Scope: Confidentiality, Integrity, and Availability – all fully impacted
High-Level Description
In vulnerable versions of H2O-3, improper validation and handling of user-supplied input within specific REST API endpoints allows files to be written to arbitrary locations on the underlying operating system. By chaining normal platform functionality in an unintended way, attacker-controlled data can be persisted to disk outside of the intended working directory.
Because the H2O service typically runs as a long-lived process and may have write permissions to sensitive directories, successful exploitation can ultimately lead to remote code execution and full server compromise.
Technical Details
H2O-3 exposes a REST API that allows data to be uploaded, parsed into internal frames, and later exported back to disk. Two API capabilities are central to this vulnerability:
- Data parsing functionality, which accepts user-supplied input and stores it internally as a frame.
- Frame export functionality, which writes the contents of a frame to a file on disk.
In affected versions, insufficient restrictions are enforced on:
- The filename and path used during export
- The relationship between frame metadata and filesystem paths
As a result, it becomes possible for attacker-controlled content to be written to a file path of the attacker’s choosing, as long as the H2O process has write access to that location.
The vulnerability is not caused by a single dangerous API call, but rather by a logical flaw in how trusted internal operations are exposed to unauthenticated users over the network.
Why This Is Dangerous
An arbitrary file write is considered a high-impact vulnerability because it can be used as a building block for multiple attack outcomes, including:
- Writing malicious scripts or binaries to disk
- Overwriting configuration files
- Planting startup or cron-based persistence mechanisms
- Dropping web shells in directories served by a web server
In real-world deployments, this type of weakness is commonly escalated into remote code execution, especially when the service runs with elevated or overly broad permissions.
Exploitability and PoC Availability
- Exploitability: High
- Public exploit code: Limited proof-of-concepts have been described for educational and research purposes
- Weaponization risk: High in exposed environments
While full weaponized exploits are not broadly published, the attack flow is straightforward for an attacker familiar with REST APIs and file-system behavior. Because no authentication is required by default, internet-exposed instances are especially at risk.
MITRE ATT&CK Mapping
The following ATT&CK techniques are relevant when this vulnerability is abused:
- T1105 – Ingress Tool Transfer: Files are written to the target system
- T1059 – Command and Script Interpreter: Follow-on execution of written scripts
- T1547 – Boot or Logon Autostart Execution: Persistence via written startup files
- T1078 – Valid Accounts: Potential lateral movement after compromise
These mappings are provided to assist in detection engineering and threat modeling.
Indicators of Compromise (IoCs)
Signs that exploitation may have occurred include:
- Unexpected file creation or modification by the H2O service account
- Files appearing in system or application directories that are not part of the normal H2O installation
- Unusual export activity occurring without legitimate user workflows
- New executable files or scripts written shortly after API activity
Detection and Monitoring Guidance
Relevant Log Sources
To detect exploitation attempts or successful abuse, monitoring should focus on:
- Reverse proxy / web server logs (Nginx, Apache, load balancers)
- H2O application logs
- Operating system audit logs
- Endpoint Detection & Response (EDR) telemetry
- File integrity monitoring systems
Behavioral Detection Strategy
Rather than relying on single indicators, detection should focus on sequences and anomalies, such as:
- Repeated or unusual requests to data parsing endpoints
- Export operations writing files outside expected directories
- File writes performed by the H2O process to sensitive locations
- Sudden appearance of executable or script files owned by the H2O user
Detection Logic
- Alert when the H2O service writes files outside its designated data directory
- Alert when file extensions such as
.sh,.py,.jsp,.php, or binaries are written by the H2O process - Correlate API requests with file creation events occurring within a short time window
These detections can be implemented in SIEM, EDR, or host-based monitoring tools depending on the environment.
Temporary Mitigations
If immediate patching is not possible, the following controls are strongly recommended:
- Restrict network access to the H2O API (internal access only)
- Enforce authentication and authorization in front of the API using a reverse proxy
- Run H2O under a dedicated low-privilege system account
- Apply filesystem permissions that limit write access to a single controlled directory
- Disable or strictly control export functionality where feasible
These mitigations reduce risk but do not fully eliminate the vulnerability.
Official Patch / Upgrade Guidance
The issue has been addressed by the H2O project, and users are advised to upgrade to a fixed release as soon as possible.
Official security and patch information:
👉 https://github.com/h2oai/h2o-3/security
Only official releases from the H2O project should be used to remediate this vulnerability.
Risk Assessment Summary
CVE-2024-5986 represents a critical risk for any organization running vulnerable H2O-3 versions, particularly when the service is exposed to untrusted networks. Due to the simplicity of exploitation and the severity of impact, this vulnerability should be treated as a priority remediation item.
Failure to patch or isolate affected systems may result in full server compromise, data loss, or lateral movement within the environment.
Final Takeaway
Immediate upgrade to the patched H2O-3 version is strongly recommended. Until patching is completed, strict network isolation and enhanced monitoring should be enforced.
