CVE-2024-10572: H2O Denial of Service (DoS) Vulnerability

CVE-2024-10572 Overview

CVE-2024-10572 affects h2oai/h2o-3 version 3.46.0.1, an open-source machine learning platform. The run_tool command exposes classes in the water.tools package through the ast parser. Attackers can invoke the XGBoostLibExtractTool class to shut down the server or write large files to arbitrary directories. Exploitation results in denial of service against the H2O-3 instance. The vulnerability is classified under [CWE-94] Improper Control of Generation of Code (Code Injection) and requires no authentication or user interaction.

Critical Impact
Unauthenticated network attackers can shut down H2O-3 servers and exhaust disk space by writing large files to arbitrary directories, disrupting machine learning workloads.

Affected Products

H2O h2o-3 version 3.46.0.1
Deployments exposing the run_tool command via ast parser
Installations invoking water.tools package classes including XGBoostLibExtractTool

Discovery Timeline

2025-03-20 - CVE-2024-10572 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-10572

Vulnerability Analysis

H2O-3 exposes a run_tool command that routes user input through the ast parser. The parser resolves and invokes classes from the water.tools package. This design permits callers to reach any tool class registered in that package without access controls. The XGBoostLibExtractTool class provides functionality that extracts native XGBoost libraries to a caller-specified path. Attackers abuse this behavior to write large binary payloads to arbitrary directories and to trigger a server shutdown path. The result is a denial of service against the H2O-3 process and, potentially, the host file system.

Root Cause

The root cause is improper control of code generation and class resolution [CWE-94]. The ast parser exposes internal tool classes as an implicit remote interface. No authentication, authorization, or allowlist restricts which classes callers can invoke through run_tool. Sensitive operational tools intended for local administrative use become reachable over the network.

Attack Vector

An attacker sends a crafted request to the H2O-3 service invoking run_tool with the XGBoostLibExtractTool target. The attacker supplies a destination path to write native library artifacts. Repeated invocations exhaust disk capacity or overwrite files at attacker-chosen locations. A second invocation path terminates the server process, halting active jobs and model serving.

No verified public exploit code is available. See the Huntr Bug Bounty Report for technical details.

Detection Methods for CVE-2024-10572

Indicators of Compromise

HTTP requests to the H2O-3 REST endpoint containing run_tool with a tool parameter referencing XGBoostLibExtractTool or other water.tools classes
Unexpected large binary files written outside standard H2O-3 working directories
Abrupt H2O-3 process termination without operator action or scheduled shutdown
Disk utilization spikes on hosts running H2O-3 without corresponding job activity

Detection Strategies

Monitor H2O-3 access logs for run_tool invocations and alert on classes outside an approved allowlist
Correlate H2O-3 process exit events with preceding network requests to identify remote shutdown attempts
Track file creation events in filesystem paths not owned by the H2O-3 service account

Monitoring Recommendations

Enable verbose request logging on the H2O-3 REST interface and forward logs to a centralized SIEM
Configure disk usage thresholds on hosts running H2O-3 to detect rapid space consumption
Alert on H2O-3 service restarts and correlate with authentication and network access logs

How to Mitigate CVE-2024-10572

Immediate Actions Required

Restrict network access to H2O-3 instances so only trusted clients on isolated networks can reach the REST API
Place H2O-3 behind an authenticating reverse proxy that blocks run_tool requests from untrusted sources
Audit H2O-3 hosts for unexpected files written by the service account and remove attacker-planted artifacts
Run H2O-3 under a low-privilege service account with write access limited to required working directories

Patch Information

No vendor patch is referenced in the NVD entry for CVE-2024-10572. Users should monitor the h2oai/h2o-3 project for updates addressing the run_tool exposure and upgrade to a fixed release when available. Review the Huntr Bug Bounty Report for vendor coordination status.

Workarounds

Disable or firewall the run_tool endpoint at the network perimeter until a patched release is deployed
Bind the H2O-3 listener to localhost on shared systems and require SSH tunneling for remote access
Deploy web application firewall rules that block requests referencing water.tools classes in the ast parameter
Enforce filesystem quotas on the H2O-3 service account to limit damage from arbitrary file writes

bash

# Configuration example: restrict H2O-3 access with iptables and quotas
iptables -A INPUT -p tcp --dport 54321 -s 10.0.0.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 54321 -j DROP

# Enforce disk quota on the H2O-3 service account
setquota -u h2o 5242880 5242880 0 0 /var