CVE-2024-5986: h2o-3 Arbitrary File Write via Parse and Export Endpoints
CVE-2024-5986 affects h2oai/h2o-3 version 3.46.0.1 and, according to the record, allows remote attackers to write arbitrary data to files on the server. The record links this to CWE-73 and assigns a CVSS 3.0 base score of 9.1 (Critical) from the CNA security@huntr.dev. No confirmed exploitation appears in the sources consulted, and no fixed version is listed in the record.
Overview
CVE-2024-5986 is reported in the h2oai/h2o-3 project at version 3.46.0.1. According to the record, a remote attacker can write attacker-controlled data to arbitrary files on the server. The record classifies the weakness as CWE-73.
Impact
- The record describes potential remote code execution and complete access to the host running h2o-3, because critical files such as private SSH keys or script files could be overwritten.
- The CVSS 3.0 base score from security@huntr.dev is 9.1 (Critical). The vector indicates network attack, low complexity, no privileges, no user interaction, and high integrity and availability impact.
Affected products and versions
- The record explicitly names h2oai/h2o-3 version 3.46.0.1.
- The structured list of affected products and versions in the record is empty, so the full affected range is unknown.
Exploitation status
No confirmed exploitation appears in the sources consulted. The record shows this CVE is not listed in the CISA KEV catalog, and no EPSS score is available.
Remediation and mitigation
- The record lists no fixed version. Check the project's repository and the huntr bounty page for updates.
- Plan to move to a release that addresses the issue once the vendor identifies one. Until then, restrict network access to h2o-3 services to trusted hosts only.
- Run the service with least privilege and limit write permissions on sensitive files and directories.
Detection guidance
- Review service and network logs for requests to parsing and frame export functions from untrusted sources.
- Monitor the file system for unexpected modification of sensitive files, including SSH configuration and scripts used by the service.
Limitations of the available information
- The record does not provide a fixed version, a complete affected version range, or a vendor advisory.
- The record does not provide a CWE name or a title, so the title in this analysis is descriptive.
- The record's source status is Deferred, so later analysis may change the details.
- Sources consulted: NVD entry and CVE record.
Frequently asked questions
What does CVE-2024-5986 allow?
According to the record, a remote attacker can write attacker-controlled data to arbitrary files on the server running h2oai/h2o-3 version 3.46.0.1.
Is CVE-2024-5986 known to be actively exploited?
No confirmed exploitation appears in the sources consulted. The record shows the CVE is not listed in CISA KEV and has no EPSS score.
Which version is fixed?
The record does not list a fixed version. Check the project repository and the huntr bounty page for updates, and restrict network access until a fix is confirmed.
This analysis was drafted with AI assistance from verified source data and automatically checked against it.