CVE-2024-8616: H2o H2o Path Traversal Vulnerability

CVE-2024-8616 Overview

CVE-2024-8616 is an arbitrary file overwrite vulnerability in h2oai/h2o-3 version 3.46.0, an open-source machine learning platform. The flaw resides in the /99/Models/{name}/json endpoint, which is handled by the exportModelDetails function in ModelsHandler.java. The user-controllable mexport.dir parameter specifies the file path used to write model details, allowing an unauthenticated attacker to write to arbitrary locations on the host filesystem. This weakness is categorized under [CWE-73] (External Control of File Name or Path).

Critical Impact
An unauthenticated remote attacker can overwrite arbitrary files on the h2o-3 host, enabling integrity compromise and potential denial of service against the machine learning service.

Affected Products

h2oai/h2o-3 version 3.46.0
Deployments exposing the /99/Models/{name}/json REST endpoint
Machine learning environments running the affected h2o-3 build

Discovery Timeline

2025-03-20 - CVE-2024-8616 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-8616

Vulnerability Analysis

The vulnerability exists in the model export functionality of h2o-3. When a client invokes the /99/Models/{name}/json endpoint, the exportModelDetails function in ModelsHandler.java reads the mexport.dir request parameter and uses it directly as the destination path for writing serialized model details.

Because the endpoint does not validate or constrain the supplied path, an attacker can supply any absolute path reachable by the h2o-3 process. The server then writes JSON model output over the target file, replacing existing content. The attack requires no authentication and no user interaction, and it can be executed remotely over the network.

Exploitation is limited to file overwrite rather than direct arbitrary read or code execution. However, overwriting service configuration files, startup scripts, or shared libraries can lead to secondary impact, including denial of service and, in some deployment layouts, code execution during the next process load.

Root Cause

The root cause is external control of a filesystem path. The mexport.dir parameter is treated as trusted input and passed to file-writing routines without canonicalization, allowlisting, or containment inside a designated export directory. This matches the [CWE-73] pattern where user input governs the target of a file operation.

Attack Vector

The attack vector is a single unauthenticated HTTP request to the /99/Models/{name}/json endpoint with a crafted mexport.dir value pointing outside the intended export directory. Any h2o-3 instance reachable on the network is exposed. Refer to the Huntr Security Bounty report for the disclosure details.

// No verified proof-of-concept code is published.
// See the Huntr disclosure linked above for technical details.

Detection Methods for CVE-2024-8616

Indicators of Compromise

HTTP requests to /99/Models/{name}/json containing a mexport.dir parameter with absolute paths or traversal sequences such as ../
Unexpected writes to system directories or configuration files by the h2o-3 process user
New or modified files outside the configured model export directory with timestamps matching h2o-3 API activity

Detection Strategies

Inspect h2o-3 access logs for requests to the /99/Models/{name}/json endpoint and alert on mexport.dir values that resolve outside an approved base path
Monitor filesystem integrity for critical files including /etc, service unit files, and Java classpath directories writable by the h2o-3 service account
Correlate web request telemetry with file creation events on the host to identify path-traversal write patterns

Monitoring Recommendations

Enable audit logging (for example, Linux auditd on open and write syscalls) for the h2o-3 process to capture out-of-scope file writes
Forward h2o-3 REST API logs and host file integrity events to a centralized SIEM for correlation
Track process behavior of the h2o-3 JVM and alert on writes to paths outside the designated model output directory

How to Mitigate CVE-2024-8616

Immediate Actions Required

Restrict network access to the h2o-3 REST API so it is reachable only from trusted management networks
Run the h2o-3 process under a dedicated low-privilege service account with write access limited to the model export directory
Audit historical logs for prior invocations of /99/Models/{name}/json with suspicious mexport.dir values and validate file integrity on the host

Patch Information

No vendor advisory or fixed version is listed in the enriched CVE data at the time of publication. Operators should track the Huntr Security Bounty report and the h2oai/h2o-3 project repository for a release addressing the exportModelDetails path handling.

Workarounds

Place h2o-3 behind an authenticating reverse proxy that blocks unauthenticated access to /99/Models/{name}/json
Enforce filesystem-level containment using OS controls such as chroot, containers, or mandatory access control (SELinux/AppArmor) so the process cannot write outside an approved directory
Add a web application firewall rule that rejects requests carrying absolute paths or traversal sequences in the mexport.dir parameter

bash

# Example: block requests containing suspicious mexport.dir values at an nginx reverse proxy
location ~ ^/99/Models/.*/json$ {
    if ($arg_mexport_dir ~* "^/|\.\./") {
        return 403;
    }
    proxy_pass http://h2o3_backend;
}