CVE-2023-6569

Advisory

Affected versions of H2o are vulnerable to External Control of File Name or Path. Remote unauthenticated attackers can overwrite arbitrary server files with attacker-controllable data. The data that the attacker can control is not entirely arbitrary. H2o writes a CSV/XLS/etc file to disk, so the attacker data is wrapped in quotations and starts with "C1", if they're exporting as CSV.
The vulnerable code is found in /h2o/backend/bin/h2o.jar

Affected package

Affected versions

Fixed versions

Vulnerability changelog

This vulnerability has no description

Resources

• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-6569
• https://huntr.com/bounties/a5d003dc-c23e-4c98-8dcf-35ba9252fa3c
• https://github.com/advisories/GHSA-gqrq-j6pm-98c2