H2O Local File Include

The stored XSS vulnerability in H2O allows an attacker to inject malicious scripts into the application. These scripts are then executed in the browsers of unsuspecting users who visit the affected pages. The subsequent Local File Inclusion (LFI) attack amplifies the impact, enabling an attacker to read arbitrary files from the server's filesystem. This could expose sensitive data like configuration files, source code, or even credentials. Successful exploitation could lead to complete system compromise, data breaches, and denial of service.

Organizations utilizing H2O for machine learning and data science applications are at risk, particularly those with legacy configurations or those who haven't implemented robust input validation and output encoding practices. Shared hosting environments using H2O are also at increased risk due to the potential for cross-tenant exploitation.

1. 2023-11-16Disclosure

   disclosure

1. Reserviert2023-11-08
2. Veröffentlicht2023-11-16
3. Geändert2024-11-27
4. EPSS aktualisiert2026-04-02

Due to the lack of a specific patch, immediate mitigation focuses on reducing the attack surface. Implement strict input sanitization and validation on all user-supplied data to prevent XSS injection. Configure H2O with the principle of least privilege, limiting its access to only the necessary files and directories. Consider using a Web Application Firewall (WAF) with XSS protection rules to filter malicious requests. Regularly review and update H2O's configuration to ensure it adheres to security best practices. Monitor logs for suspicious activity, such as attempts to access unusual files.