CVE-2024-5550: 
NixOS vulnerability analysis and mitigation

In h2oai/h2o-3 version 3.40.0.4, an exposure of sensitive information vulnerability exists due to an arbitrary system path lookup feature. The vulnerability was discovered and disclosed on June 6, 2024, affecting the h2o-3 software platform (NVD).

The vulnerability resides in the Typeahead API call functionality. When requested with a typeahead lookup of '/', the system exposes the root filesystem including sensitive directories such as /home, /usr, /bin, and others. The vulnerability has been assigned a CVSS v3.1 base score of 5.3 (MEDIUM) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N (NVD).

This vulnerability allows any remote user to view full paths in the entire file system where h2o-3 is hosted. The exposure of system directory structures could provide attackers with valuable information about the system architecture and potential attack vectors. When combined with a Local File Inclusion (LFI) vulnerability, this could make exploitation of the server trivial (NVD).

The vulnerability is remotely exploitable without requiring any authentication or user interaction. The attack complexity is considered low, making it relatively straightforward for attackers to exploit (NVD, Huntr).