CVE-2024-45758: H2O.ai H2O Vulnerable to Deserialization Attacks via JDBC Connection URL
Summary
CVE-2024-45758: H2O.ai H2O vulnerable to deserialization attacks via a JDBC Connection URL. Affects ai.h2o:h2o-core versions < 3.46.0.7. No fix is published. How to fix ↓
Also tracked for
- h2o · PyPI
The same CVE-2024-45758 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
H2O.ai H2O is an open-source machine learning platform that provides a suite of tools for data analysis and predictive modeling. It allows users to build and deploy machine learning models quickly and efficiently. The platform is widely used in various industries for its scalability and ease of use. However, a critical vulnerability has been identified that exposes it to deserialization attacks through improperly handled JDBC Connection URLs.
Vulnerability Detail
The vulnerability in H2O.ai H2O, identified as CVE-2024-45758, allows attackers to manipulate the JDBC URL, leading to potential deserialization attacks. This occurs when an attacker can post to the ImportSQLTable URI with a JSON document that includes a malicious connection_url property. Such exploitation can result in unauthorized file reads and command execution, posing significant risks to the integrity and confidentiality of the system.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, ensure that the application does not accept arbitrary JDBC URLs from untrusted sources. Implement strict validation and sanitization of input data to mitigate the risk of deserialization attacks.
Conclusion
The vulnerability CVE-2024-45758 in H2O.ai H2O poses significant risks due to its potential for deserialization attacks via JDBC Connection URLs. It is crucial for users to update their packages to the patched version or implement workarounds to mitigate risks until they can apply the fix.
See every vulnerability recorded for ai.h2o:h2o-core →
FAQ
CVE-2024-45758 is a critical vulnerability in H2O.ai H2O that allows attackers to exploit deserialization through manipulated JDBC Connection URLs.
You can check if your application is affected by using Vulert, which monitors open-source vulnerabilities in real-time. Visit Vulert Scanner to analyze your pom.xml without any signup.
Exploitation of this vulnerability can lead to unauthorized file access, command execution, and significant data breaches.
Yes, a patch is available in version 3.46.0.8 and later of the H2O package. It is recommended to update to this version.
If immediate updates are not possible, implement input validation and restrict JDBC URL submissions to trusted sources as a temporary measure.
References
Related vulnerabilities
Recent vulnerabilities recorded for ai.h2o:h2o-core.
