CVE-2024-10553

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-10553
A vulnerability in the h2oai/h2o-3 REST API versions 3.46.0.4 allows unauthenticated remote attackers to execute arbitrary code via deserialization of untrusted data. The vulnerability exists in the endpoints POST /99/ImportSQLTable and POST /3/SaveToHiveTable, where user-controlled JDBC URLs are passed to DriverManager.getConnection, leading to deserialization if a MySQL or PostgreSQL driver is available in the classpath. This issue is fixed in version 3.47.0.

9.8 /10

CVSS v3 : CRITICAL

V3 Legend

Vector : AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://github.com/h2oai/h2o-3/commit/ac1d642b4d86f10a02d75974055baf2a4b2025ac Patch
https://huntr.com/bounties/e6f550dd-eda2-428c-a740-ed8f893a084b Exploit Third Party Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:h2o:h2o:3.46.0.4:*:*:*:*:*:*:*
History

14 Jul 2025, 13:43

Type Values Removed Values Added
First Time H2o
H2o h2o
CPE cpe:2.3:a:h2o:h2o:3.46.0.4:*:*:*:*:*:*:*
Summary
  • (es) Una vulnerabilidad en la API REST h2oai/h2o-3, versiones 3.46.0.4, permite a atacantes remotos no autenticados ejecutar código arbitrario mediante la deserialización de datos no confiables. La vulnerabilidad existe en los endpoints POST /99/ImportSQLTable y POST /3/SaveToHiveTable, donde las URL JDBC controladas por el usuario se pasan a DriverManager.getConnection, lo que provoca la deserialización si hay un controlador MySQL o PostgreSQL disponible en la ruta de clases. Este problema se ha corregido en la versión 3.47.0.
References () https://github.com/h2oai/h2o-3/commit/ac1d642b4d86f10a02d75974055baf2a4b2025ac - () https://github.com/h2oai/h2o-3/commit/ac1d642b4d86f10a02d75974055baf2a4b2025ac - Patch
References () https://huntr.com/bounties/e6f550dd-eda2-428c-a740-ed8f893a084b - () https://huntr.com/bounties/e6f550dd-eda2-428c-a740-ed8f893a084b - Exploit, Third Party Advisory

20 Mar 2025, 10:15

Type Values Removed Values Added
New CVE
Information

Published : 2025-03-20 10:15

Updated : 2025-07-14 13:43

NVD link : CVE-2024-10553

Mitre link : CVE-2024-10553

CVE.ORG link : CVE-2024-10553

JSON object : View

Products Affected

h2o

  • h2o
CWE
CWE-502

Deserialization of Untrusted Data