H2O Configuration File control flow

Summaryinfo

A vulnerability classified as problematic has been found in H2O. Affected by this issue is some unknown functionality of the component Configuration File Handler. Performing a manipulation results in control flow. This vulnerability was named CVE-2024-25622. The attack may be initiated remotely. There is no available exploit. To fix this issue, it is recommended to deploy a patch.

Detailsinfo

A vulnerability, which was classified as problematic, was found in H2O (version now known). This affects some unknown processing of the component Configuration File Handler. The manipulation with an unknown input leads to a control flow vulnerability. CWE is classifying the issue as CWE-670. The code contains a control flow path that does not reflect the algorithm that the path is intended to implement, leading to incorrect behavior any time this path is navigated. This is going to have an impact on confidentiality. The summary by CVE is:

h2o is an HTTP server with support for HTTP/1.x, HTTP/2 and HTTP/3. The configuration directives provided by the headers handler allows users to modify the response headers being sent by h2o. The configuration file of h2o has scopes, and the inner scopes (e.g., path level) are expected to inherit the configuration defined in outer scopes (e.g., global level). However, if a header directive is used in the inner scope, all the definition in outer scopes are ignored. This can lead to headers not being modified as expected. Depending on the headers being added or removed unexpectedly, this behavior could lead to unexpected client behavior. This vulnerability is fixed in commit 123f5e2b65dcdba8f7ef659a00d24bd1249141be.

It is possible to read the advisory at github.com. This vulnerability is uniquely identified as CVE-2024-25622 since 02/08/2024. The exploitability is told to be difficult. It is possible to initiate the attack remotely. No form of authentication is needed for exploitation. It demands that the victim is doing some kind of user interaction. The technical details are unknown and an exploit is not publicly available.

Applying the patch 123f5e2b65dcdba8f7ef659a00d24bd1249141be is able to eliminate this problem. The bugfix is ready for download at github.com.

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Name

• H2O

License

• open-source

Website

• Product: https://github.com/h2o/h2o/

CPE 2.3info

• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion