CVE-2022-23221: Arbitrary code execution in H2 Console
Summary
CVE-2022-23221: Arbitrary code execution in H2 Console. Affects com.h2database:h2 versions < 2.1.210. Fixed in 2.1.210. How to fix ↓
Also tracked for
- h2database · Debian:11
The same CVE-2022-23221 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
H2 Console is a web-based database management tool for the H2 database engine. It provides a user-friendly interface to interact with H2 databases, allowing users to execute SQL queries, manage database objects, and perform various administrative tasks. The H2 database engine is a pure Java, open-source, and lightweight relational database management system.
Vulnerability Detail
The H2 Console before version 2.1.210 is vulnerable to arbitrary code execution. This vulnerability can be exploited by remote attackers through a jdbc:h2:mem JDBC URL that contains the substring IGNORE_UNKNOWN_SETTINGS=TRUE;FORBID_CREATION=FALSE;INIT=RUNSCRIPT. This is a separate vulnerability from CVE-2021-42392. By exploiting this vulnerability, an attacker can execute arbitrary code on the target system, potentially leading to remote code execution, data theft, or other malicious activities.
How To Fix
Minimum fixed version
2.1.210
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to update to the patched version as soon as possible to mitigate the risk of exploitation.
Conclusion
The arbitrary code execution vulnerability in H2 Console poses a significant risk to systems using vulnerable versions. It is highly recommended to update to H2 Console version 2.1.210 or later to address this vulnerability. Failure to do so may result in remote code execution, data theft, or other malicious activities. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for com.h2database:h2 →
FAQ
H2 Console is a web-based database management tool for the H2 database engine. It provides a user-friendly interface to interact with H2 databases, allowing users to execute SQL queries, manage database objects, and perform various administrative tasks.
The vulnerability occurs due to insufficient input validation in the H2 Console. By crafting a specific JDBC URL, an attacker can trigger the arbitrary code execution vulnerability.
Exploiting this vulnerability can lead to arbitrary code execution on the target system. This can result in remote code execution, data theft, or other malicious activities, depending on the intentions of the attacker.
Yes, the vulnerability can be fixed by upgrading to H2 Console version 2.1.210 or later. This version includes a patch that addresses the arbitrary code execution vulnerability.
No, there are no known workarounds for this vulnerability. It is crucial to update to the patched version to mitigate the risk of exploitation.
Related vulnerabilities
Recent vulnerabilities recorded for com.h2database:h2.
