Critical Remote Code Execution Vulnerability in H2 Database
Summary
CVE-2021-42392: The org.h2.util.JdbcUtils.getConnection method of the H2 database takes as parameters the class name of the driver and URL of the database. Affects h2database across 2 version ranges.
< 1.4.197-4+deb11u1
< 76994fd0ae92cce4660aa10491a7b6bb7680727a
Fixed in 1.4.197-4+deb11u1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
H2 Database is an open-source, lightweight, and fast relational database management system written in Java. It is often used for development, testing, and in production environments due to its simplicity and ease of integration. The database supports various features such as in-memory databases, JDBC API, and SQL compatibility. However, it is vulnerable to a critical issue that allows attackers to execute arbitrary code remotely.
Vulnerability Detail
The vulnerability, identified as CVE-2021-42392, arises from the org.h2.util.JdbcUtils.getConnection method, which accepts a driver class name and a database URL. An attacker can exploit this by providing a JNDI driver name and a URL pointing to an LDAP or RMI server, leading to remote code execution. This issue can be exploited through various attack vectors, particularly via the H2 Console, allowing unauthenticated remote code execution. The CVSS score for this vulnerability is 9.8, indicating a high severity level.
How To Fix
Minimum fixed version
1.4.197-4+deb11u1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade h2databaseTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, disable the H2 Console if it is not needed, or restrict access to it by implementing proper authentication and authorization controls. Additionally, avoid using JNDI driver names in the connection parameters until the package is updated.
Conclusion
CVE-2021-42392 is a significant vulnerability in the H2 Database that poses a serious risk of remote code execution. It is crucial for users to update their installations to the latest versions to safeguard against potential attacks. Implementing workarounds can provide temporary relief, but a permanent fix through updates is essential.
See every vulnerability recorded for h2database →
FAQ
CVE-2021-42392 is a critical vulnerability in the H2 Database that allows remote code execution through the misuse of JNDI driver names and URLs.
You can check if your application is affected by using Vulert, which monitors open-source vulnerabilities in your software. Visit Vulert Scanner to analyze your manifest file.
If exploited, this vulnerability can allow attackers to execute arbitrary code on the server, potentially leading to data breaches, system compromise, and loss of integrity.
If immediate updates are not feasible, implement workarounds such as disabling the H2 Console and restricting access to sensitive components of your application.
More information can be found in the official CVE database and security advisories related to the H2 Database.
Related vulnerabilities
Recent vulnerabilities recorded for h2database.
