Cleartext Password Exposure in H2 Database Engine - CVE-2022-45868
Summary
DEBIAN-CVE-2022-45868: The web-based admin console in H2 Database Engine before 2.2.220 can be started via the CLI with the argument -webAdminPassword, which allows the user to specify the password in cleartext for the web admin console. Affects h2database versions 1.4.197-4 – 2.2.220-1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
H2 Database Engine is a popular open-source relational database management system written in Java. It is known for its lightweight nature, fast performance, and ease of use, making it suitable for both development and production environments. The database engine includes a web-based admin console that allows users to manage databases through a graphical interface. However, a vulnerability was discovered that allows sensitive information, specifically passwords, to be exposed in cleartext when starting the console with certain command-line arguments.
Vulnerability Detail
The vulnerability arises from the ability to start the H2 Database Engine's web-based admin console with the '-webAdminPassword' argument, which allows the user to specify the admin password in cleartext. This means that any local user or attacker with local access can list the running processes and their arguments, potentially exposing the admin password. The vendor has noted that this is not a flaw in the H2 Console itself, as best practices dictate that passwords should not be passed via the command line. Nonetheless, the issue poses a security risk, especially in environments where multiple users have access to the system.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a workaround, avoid using the '-webAdminPassword' argument when starting the H2 Database Engine's web console. Instead, consider using environment variables or configuration files to securely manage passwords without exposing them in command-line arguments.
Conclusion
CVE-2022-45868 presents a significant risk by allowing the exposure of admin passwords in cleartext through command-line arguments. Users of H2 Database Engine should promptly update to version 2.2.220 or later to mitigate this vulnerability. Additionally, following best practices for password management and access control is essential to maintain database security.
See every vulnerability recorded for h2database →
FAQ
CVE-2022-45868 is a vulnerability in the H2 Database Engine that allows passwords to be exposed in cleartext when starting the web admin console with specific command-line arguments.
If an attacker gains local access to your system, they could potentially discover the admin password, leading to unauthorized access to your databases.
All versions of H2 Database Engine prior to 2.2.220 are affected by this vulnerability.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without needing to sign up.
If an immediate update is not possible, ensure that you do not use the '-webAdminPassword' argument and consider implementing additional security measures to restrict local access to your system.
References
Related vulnerabilities
Recent vulnerabilities recorded for h2database.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
