CVE-2024-6854: H2O Path Traversal Vulnerability

CVE-2024-6854 Overview

CVE-2024-6854 affects h2oai/h2o-3 version 3.46.0, an open-source machine learning platform. The model export endpoint fails to restrict the destination path when writing trained model files. Authenticated attackers can specify arbitrary file paths on the server, causing the endpoint to overwrite existing files with the exported model content. While the attacker cannot control the content written, the ability to overwrite arbitrary files on the host enables denial of service and integrity attacks against system binaries, configuration files, and application data. The flaw is categorized under [CWE-36] (Absolute Path Traversal).

Critical Impact
An attacker with network access to the h2o-3 API can overwrite any file writable by the h2o-3 process, including configuration files and application binaries, resulting in loss of integrity and availability.

Affected Products

h2oai/h2o-3 version 3.46.0
Deployments exposing the model export API endpoint
Machine learning pipelines built on affected h2o-3 releases

Discovery Timeline

2025-03-20 - CVE-2024-6854 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-6854

Vulnerability Analysis

The vulnerability resides in the h2o-3 model export functionality. The endpoint accepts a destination path parameter from the client and passes it directly to the underlying file write operation. No validation restricts the path to a designated export directory. An authenticated user can therefore direct the write to any location on the file system that the h2o-3 process can access.

Because h2o-3 typically runs with the privileges of the service account hosting the machine learning workload, the write can target application configuration, cron files, or system libraries reachable by that account. The written content is a serialized trained model, so attackers cannot inject controlled bytes, but they can destroy the integrity of the targeted file.

Root Cause

The root cause is missing path validation on user-supplied file destinations. The export handler treats the path parameter as a trusted absolute path rather than resolving it against an allow-listed base directory. This maps directly to [CWE-36], where an absolute path supplied by an untrusted source is used without canonicalization or containment checks.

Attack Vector

Exploitation requires network access to the h2o-3 REST API and a valid low-privilege account on the platform. The attacker trains or loads any model, then invokes the export endpoint with a target path such as a system configuration file. The service overwrites the target file with the model artifact. Repeated requests can corrupt multiple files, disable the h2o-3 service itself, or destabilize the host operating system. See the Huntr Vulnerability Bounty report for the original disclosure details.

Detection Methods for CVE-2024-6854

Indicators of Compromise

Unexpected writes by the h2o-3 process to paths outside the configured model export directory.
Model export API requests where the destination path parameter contains absolute paths to system directories such as /etc, /var, or Windows program directories.
Corrupted or replaced configuration files whose modification timestamp aligns with h2o-3 API activity.

Detection Strategies

Enable request logging on the h2o-3 API and alert on export calls whose target path escapes the intended model directory.
Deploy file integrity monitoring against critical system and application paths on hosts running h2o-3.
Correlate authenticated h2o-3 sessions with file write events on the host to surface anomalous export destinations.

Monitoring Recommendations

Forward h2o-3 access logs and host file system audit events to a centralized analytics platform for correlation.
Baseline normal export paths and alert on deviations, particularly paths outside the model store.
Monitor for h2o-3 service crashes or configuration reloads that follow export API activity.

How to Mitigate CVE-2024-6854

Immediate Actions Required

Restrict network access to the h2o-3 API to trusted internal users and management networks only.
Run the h2o-3 process under a dedicated, least-privileged service account with no write access to system directories.
Audit existing accounts on h2o-3 and remove or rotate credentials for users who no longer require access.

Patch Information

No vendor advisory or fixed version is referenced in the enriched CVE data. Consult the Huntr Vulnerability Bounty report and the h2oai project for the current remediation status before upgrading. Until a confirmed fix is available, apply the compensating controls listed below.

Workarounds

Place the h2o-3 process inside a container or chroot with a read-only root file system and a single writable directory for model exports.
Use mandatory access controls such as SELinux or AppArmor to deny writes by the h2o-3 process outside its designated export path.
Front the h2o-3 API with a reverse proxy that inspects and rejects export requests containing absolute paths or path traversal sequences.

bash

# Example AppArmor profile snippet restricting h2o-3 writes to an export directory
/opt/h2o/export/** rw,
deny /etc/** w,
deny /var/** w,
deny /usr/** w,