The H2 Database is widely used as an in-memory database within Java applications, providing a lightweight yet powerful solution for handling relational database operations. It is often employed in web applications, embedded systems, and unit testing to provide persistence without the overhead of traditional database systems. The H2 web console, part of the H2 Database package, offers users a graphical interface for database management and querying. This console can be enabled to allow users to interactively connect, execute SQL commands, and retrieve data from their H2-managed databases. As an embedded database engine, H2 is beneficial for rapid development cycles and applications requiring fast data access.
JNDI Injection is a critical vulnerability that allows an attacker to manipulate Java Naming and Directory Interface (JNDI) lookups in applications. By exploiting this flaw within the H2 Database web console, attackers can direct JNDI references to attack servers, leading to unauthorized operations. The vulnerability arises from insufficient validation on user input, particularly on URL parameters when establishing database connections. Remote attackers can exploit the web console when it is enabled, achieving Remote Code Execution (RCE) without requiring authentication.
For the JNDI Injection vulnerability in H2 Database, the weakness lies in the `JdbcUtils.getConnection` method, which accepts the driver name and database URL as parameters. Attackers may provide an LDAP or RMI URL pointing to a malicious server, allowing them to execute arbitrary code via JNDI lookups. The vulnerable endpoint is within the web console interface, essential for query execution on database entities in affected versions. As the console processes the manipulated URL, it triggers the malicious server and potentially executes harmful commands on the host system.
If an attacker successfully exploits the H2 Database JNDI Injection flaw, they could fully control the host system via remote code execution. Such control can lead to data theft, unauthorized data modification, or using the compromised host for further network attacks. Additionally, it can undermine data integrity within the database, inject malware, or create a persistent backdoor for future intrusions.
REFERENCES
- https://jfrog.com/blog/the-jndi-strikes-back-unauthenticated-rce-in-h2-database-console/
- https://github.com/advisories/GHSA-h376-j262-vhq6
- https://github.com/h2database/h2database/commit/b24aa46f48904ce64443f8f4353d70a2eed09037
- https://nvd.nist.gov/vuln/detail/CVE-2021-42392
- https://github.com/vulhub/vulhub/tree/master/h2database/CVE-2021-42392
- Upgrade H2 Database to version 2.0.206 or later to ensure the vulnerability is patched.
- Disable the H2 web console using the configuration `spring.h2.console.enabled=false` to prevent exploitation through the console.
- Implement network segmentation and firewall rules to restrict access to the H2 Database console to authorized administrators.
- Regularly monitor and audit systems for suspicious activities or configuration changes related to JNDI lookups.
- Conduct security awareness training to inform developers and administrators about the risks of insecure JNDI lookups and proper configuration practices.
Get AI-powered remediation steps tailored to your asset.
Try AI Solutions →