Skip to main content

Exposed Dangerous Method or Function

CVE-2024-6863

Medium
6.5/10

Summary

In h2oai/h2o-3, an endpoint exposing a custom `EncryptionTool` allows an attacker to encrypt any files on the target server with a key of their choosing. The chosen key can also be overwritten, resulting in `ransomware-like` behavior. This vulnerability makes it possible for an attacker to encrypt arbitrary files with keys of their choice, making it exceedingly difficult for the target to recover the keys needed for decryption. This issue affects both Maven-ai.h2o:h2o-core and Pypi-h2o package versions 3.32.1.2 and after.

  • LOW
  • NETWORK
  • LOW
  • UNCHANGED
  • NONE
  • NONE
  • NONE
  • LOW

CWE-749 - Exposed Dangerous Method or Function

The software provides an Applications Programming Interface (API) or similar interface for interaction with external actors, but the interface includes a dangerous method or function that is not properly restricted.

References

Advisory Timeline

  • Published