Remote Code Execution Vulnerability in H2Database Package
Summary
DEBIAN-CVE-2022-23221: H2 Console before 2.1.210 allows remote attackers to execute arbitrary code via a jdbc:h2:mem JDBC URL containing the IGNORE_UNKNOWN_SETTINGS=TRUE;FORBID_CREATION=FALSE;INIT=RUNSCRIPT substring, a different vulnerability... Affects h2database versions < 1.4.197-4+deb11u1. Fixed in 1.4.197-4+deb11u1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
H2Database is a popular open-source relational database management system written in Java. It is known for its lightweight nature and is often used for development and testing purposes. The package provides a console interface for database management, allowing users to execute SQL commands and manage database schemas. However, a vulnerability has been identified in versions prior to 2.1.210 that allows remote attackers to execute arbitrary code through specific JDBC URL configurations.
Vulnerability Detail
The vulnerability, identified as CVE-2022-23221, affects the H2 Console prior to version 2.1.210. It allows remote attackers to execute arbitrary code by crafting a malicious JDBC URL that includes the parameters IGNORE_UNKNOWN_SETTINGS=TRUE;FORBID_CREATION=FALSE;INIT=RUNSCRIPT. This vulnerability poses a significant risk as it can lead to unauthorized access and control over the database environment, potentially compromising sensitive data and application integrity.
How To Fix
Minimum fixed version
1.4.197-4+deb11u1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade h2databaseTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, avoid using the vulnerable JDBC URL configurations that include the IGNORE_UNKNOWN_SETTINGS and FORBID_CREATION parameters until the package can be updated.
Conclusion
The H2Database package has a critical vulnerability that allows remote code execution through specific JDBC URL configurations. It is crucial for users to update to the patched versions to mitigate the risks associated with this vulnerability. Regular monitoring and updates are essential for maintaining application security.
See every vulnerability recorded for h2database →
FAQ
CVE-2022-23221 is a vulnerability in the H2Database package that allows remote code execution through malicious JDBC URLs.
Versions of H2Database prior to 2.1.210 are affected by this vulnerability.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The risks include unauthorized access to the database, potential data breaches, and the ability for attackers to execute arbitrary code on the server.
To protect your application, update the H2Database package to the latest patched version and avoid using the vulnerable JDBC URL configurations.
References
Related vulnerabilities
Recent vulnerabilities recorded for h2database.
