CVE-2024-5979
📋 TL;DR
This vulnerability in h2oai/h2o-3 version 3.46.0 allows attackers to call the main function of any class under the water.tools namespace via the run_tool command. Specifically, invoking MojoConvertTool with invalid arguments crashes the server, causing denial of service. Organizations using h2o-3 version 3.46.0 are affected.
💻 Affected Systems
- h2oai/h2o-3
📦 What is this software?
H2o by H2o
⚠️ Risk & Real-World Impact
Worst Case
Complete service disruption through repeated DoS attacks, potentially affecting downstream applications and business operations.
Likely Case
Intermittent server crashes causing service interruptions and degraded performance.
If Mitigated
Minimal impact with proper network segmentation and access controls limiting exposure.
🎯 Exploit Status
Exploit requires network access to the h2o-3 server and knowledge of the vulnerable endpoint.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Versions after commit d0899f8e0f7a584b60405a65b1d7b439aaaa55a5
Vendor Advisory: https://github.com/h2oai/h2o-3/commit/d0899f8e0f7a584b60405a65b1d7b439aaaa55a5
Restart Required: Yes
Instructions:
1. Update h2o-3 to a version containing commit d0899f8e0f7a584b60405a65b1d7b439aaaa55a5. 2. Restart the h2o-3 service. 3. Verify the fix by checking the version.
🔧 Temporary Workarounds
Disable rapids component
allTemporarily disable the vulnerable rapids component to prevent exploitation.
Modify h2o-3 configuration to disable rapids functionality
Network access restriction
linuxRestrict network access to h2o-3 server to trusted sources only.
iptables -A INPUT -p tcp --dport [h2o-port] -s [trusted-ip] -j ACCEPT
iptables -A INPUT -p tcp --dport [h2o-port] -j DROP
🧯 If You Can't Patch
- Implement strict network access controls to limit exposure to trusted sources only.
- Monitor server logs for unusual activity and implement rate limiting on the vulnerable endpoint.
🔍 How to Verify
Check if Vulnerable:
Check if h2o-3 version is 3.46.0 and if the rapids component is enabled.Check Version:
Check h2o-3 documentation or configuration files for version information.Verify Fix Applied:
Verify the h2o-3 version is updated beyond commit d0899f8e0f7a584b60405a65b1d7b439aaaa55a5 and test the run_tool command with invalid arguments.📡 Detection & Monitoring
Log Indicators:
- Server crash logs
- Unusual run_tool command invocations
- Error messages related to MojoConvertTool
Network Indicators:
- Multiple requests to the rapids endpoint with invalid arguments
- Sudden increase in error responses
SIEM Query:
source="h2o-3" AND ("run_tool" OR "MojoConvertTool" OR "server crash")