Critical Remote Code Execution Vulnerability in H2 Database Console
Summary
CVE-2022-23221: H2 Console before 2.1.210 allows remote attackers to execute arbitrary code via a jdbc:h2:mem JDBC URL containing the IGNORE_UNKNOWN_SETTINGS=TRUE;FORBID_CREATION=FALSE;INIT=RUNSCRIPT substring, a different vulnerability... Affects h2database across 2 version ranges.
< 1.4.197-4+deb11u1
< ca926f8b646aa3dd3da5f7a81bbee055b19a8d6a
Fixed in 1.4.197-4+deb11u1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
H2 is a popular open-source lightweight Java SQL database that is often used for development and testing purposes. It provides an in-memory database option, which is particularly useful for applications that require fast data access without the overhead of a full database server. The H2 Console is a web-based interface that allows users to interact with the database through a browser. However, prior to version 2.1.210, the H2 Console was susceptible to a serious vulnerability that could allow remote attackers to execute arbitrary code.
Vulnerability Detail
The vulnerability, identified as CVE-2022-23221, arises from the improper handling of JDBC URLs in the H2 Console. Specifically, an attacker can craft a malicious JDBC URL containing the substrings 'IGNORE_UNKNOWN_SETTINGS=TRUE;FORBID_CREATION=FALSE;INIT=RUNSCRIPT', which could lead to arbitrary code execution on the server. This vulnerability poses significant risks, as it can allow unauthorized access to sensitive data, manipulation of the database, and potential control over the server environment. The CVSS score for this vulnerability is 9.8, indicating a critical severity level.
How To Fix
Minimum fixed version
1.4.197-4+deb11u1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade h2databaseTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can disable the H2 Console or restrict access to it by configuring firewall rules or using authentication mechanisms to prevent unauthorized access. Additionally, avoid using JDBC URLs that include the vulnerable substrings until the upgrade is completed.
Conclusion
CVE-2022-23221 represents a serious security risk for users of the H2 database. It is crucial for users to upgrade to the fixed versions to protect their applications from potential exploitation. Implementing workarounds can provide temporary relief, but a complete upgrade is the best long-term solution.
See every vulnerability recorded for h2database →
FAQ
CVE-2022-23221 is a critical vulnerability in the H2 Console that allows remote attackers to execute arbitrary code through specially crafted JDBC URLs.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If exploited, this vulnerability can lead to unauthorized access, data manipulation, and full control over the server environment.
The vulnerability affects H2 Console versions before 2.1.210. Users should upgrade to the latest versions to mitigate the risk.
Yes, you can disable the H2 Console or restrict access through firewall rules and authentication mechanisms until you can upgrade.
Related vulnerabilities
Recent vulnerabilities recorded for h2database.
