CVE-2021-42392
h2: Remote Code Execution in Console
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
2Exploited in Wild
-Decision
Descriptions
The org.h2.util.JdbcUtils.getConnection method of the H2 database takes as parameters the class name of the driver and URL of the database. An attacker may pass a JNDI driver name and a URL leading to a LDAP or RMI servers, causing remote code execution. This can be exploited through various attack vectors, most notably through the H2 Console which leads to unauthenticated remote code execution.
El método org.h2.util.JdbcUtils.getConnection de la base de datos H2 toma como parámetros el nombre de la clase del controlador y la URL de la base de datos. Un atacante puede pasar un nombre de controlador JNDI y una URL que conlleve a un servidor LDAP o RMI, causando una ejecución de código remota. Esto puede ser explotado mediante varios vectores de ataque, sobre todo mediante la Consola H2 que conlleva a una ejecución de código remoto no autenticado
A flaw was found in h2. The org.h2.util.JdbcUtils.getConnection method of the H2 database takes as parameters the class name of the driver and URL of the database. This flaw allows an attacker to use this URL to send another server’s code, causing remote code execution. This issue is exploited through various attack vectors, most notably through the H2 Console, which leads to unauthenticated remote code execution.
CVSS Scores
SSVC
- Decision:-
Timeline
- 2021-10-14 CVE Reserved
- 2022-01-07 CVE Published
- 2022-01-17 First Exploit
- 2024-08-04 CVE Updated
- 2024-11-15 EPSS Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
CWE
- CWE-502: Deserialization of Untrusted Data
CAPEC
References (10)
| URL | Date | SRC |
|---|---|---|
| https://github.com/cybersecurityworks553/CVE-2021-42392-Detect | 2022-01-17 | |
| https://jfrog.com/blog/the-jndi-strikes-back-unauthenticated-rce-in-h2-database-console | 2024-08-04 |
| URL | Date | SRC |
|---|---|---|
| https://www.oracle.com/security-alerts/cpuapr2022.html | 2023-02-24 |
| URL | Date | SRC |
|---|---|---|
| https://www.debian.org/security/2022/dsa-5076 | 2023-02-24 | |
| https://access.redhat.com/security/cve/CVE-2021-42392 | 2022-11-03 | |
| https://bugzilla.redhat.com/show_bug.cgi?id=2039403 | 2022-11-03 |
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| H2database Search vendor "H2database" | H2 Search vendor "H2database" for product "H2" | >= 1.1.000 <= 2.0.204 Search vendor "H2database" for product "H2" and version " >= 1.1.000 <= 2.0.204" | - |
Affected
| ||||||
| Debian Search vendor "Debian" | Debian Linux Search vendor "Debian" for product "Debian Linux" | 9.0 Search vendor "Debian" for product "Debian Linux" and version "9.0" | - |
Affected
| ||||||
| Debian Search vendor "Debian" | Debian Linux Search vendor "Debian" for product "Debian Linux" | 10.0 Search vendor "Debian" for product "Debian Linux" and version "10.0" | - |
Affected
| ||||||
| Debian Search vendor "Debian" | Debian Linux Search vendor "Debian" for product "Debian Linux" | 11.0 Search vendor "Debian" for product "Debian Linux" and version "11.0" | - |
Affected
| ||||||
| Oracle Search vendor "Oracle" | Communications Cloud Native Core Policy Search vendor "Oracle" for product "Communications Cloud Native Core Policy" | 1.15.0 Search vendor "Oracle" for product "Communications Cloud Native Core Policy" and version "1.15.0" | - |
Affected
| ||||||