Vulnerability · Published Jul 21, 2024 · Assigned by JFROG

CVE-2024-6960H2O deserializes ML models without filtering, potentially allowing execution of malicious code

High 7.5

In plain English

A high-severity unsafe deserialization in ai.h2o:h2o-core. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 53% of all known vulnerabilities).

Severity (CVSS 3.1)7.5High

Exploit odds (30 days)0.7%top 47.4% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

The H2O machine learning platform uses "Iced" classes as the primary means of moving Java Objects around the cluster. The Iced format supports inclusion of serialized Java objects. When a model is deserialized, any class is allowed to be deserialized (no class whitelist). An attacker can construct a crafted Iced model that uses Java gadgets and leads to arbitrary code execution when imported to the H2O platform.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Maven	ai.h2o:h2o-core	no fix listed	GHSA-w36w-948j-xhfw

Affected products (as reported)

Vendor	Product	Versions
	ai.h2o:h2o-core	0

Weakness: CWE-502 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

References

https://research.jfrog.com/vulnerabilities/h2o-model-deserialization-rce-jfsa-2024-001035518/ third-party-advisory
https://mvnrepository.com/artifact/ai.h2o/h2o-core product