CVE-2022-23221
📋 TL;DR
This vulnerability allows remote attackers to execute arbitrary code on H2 Database Console by exploiting a flaw in JDBC URL parsing. Attackers can craft malicious URLs containing INIT=RUNSCRIPT commands to run arbitrary SQL scripts. Any system running H2 Console before version 2.1.210 with the console accessible is affected.
💻 Affected Systems
- H2 Database Console
📦 What is this software?
Communications Cloud Native Core Console by Oracle
View all CVEs affecting Communications Cloud Native Core Console →
H2 by H2database
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise with remote code execution leading to data theft, ransomware deployment, or lateral movement across the network.
Likely Case
Database compromise allowing data exfiltration, privilege escalation, or deployment of backdoors for persistent access.
If Mitigated
Limited impact if console is not exposed or properly secured with authentication and network controls.
🎯 Exploit Status
Exploit code is publicly available and requires minimal technical skill to execute. The attack can be performed through web requests to the console endpoint.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2.1.210 and later
Vendor Advisory: https://github.com/h2database/h2database/security/advisories
Restart Required: Yes
Instructions:
1. Download H2 Database version 2.1.210 or later from official sources. 2. Stop the H2 Console service. 3. Replace the existing H2 JAR files with the updated version. 4. Restart the H2 Console service. 5. Verify the version is 2.1.210 or higher.
🔧 Temporary Workarounds
Disable H2 Console
allCompletely disable the H2 Console web interface if not required for operations.
Stop the H2 Console service or remove/disable the console component from your deployment.
Network Access Controls
allRestrict network access to the H2 Console using firewall rules or network segmentation.
Configure firewall to allow only trusted IP addresses to access the H2 Console port (default 8082).
🧯 If You Can't Patch
- Implement strict network segmentation and firewall rules to isolate H2 Console from untrusted networks.
- Deploy a web application firewall (WAF) with rules to block malicious JDBC URL patterns containing INIT=RUNSCRIPT.
🔍 How to Verify
Check if Vulnerable:
Check if H2 Console is accessible on port 8082 (default) and if the version is below 2.1.210. Access the console web interface and check the version in the footer or about page.Check Version:
java -cp h2*.jar org.h2.tools.Server -? | grep -i versionVerify Fix Applied:
After patching, verify the console shows version 2.1.210 or higher. Test that malicious JDBC URLs with INIT=RUNSCRIPT no longer execute arbitrary commands.📡 Detection & Monitoring
Log Indicators:
- JDBC connection attempts with INIT=RUNSCRIPT in URL
- Unusual SQL execution patterns from console interface
- Multiple failed login attempts to console
Network Indicators:
- HTTP POST requests to /console/login.do with malicious JDBC URLs
- Traffic to H2 Console port (default 8082) from unexpected sources
SIEM Query:
source="h2-console.log" AND ("INIT=RUNSCRIPT" OR "jdbc:h2:mem:")🔗 References
- http://packetstormsecurity.com/files/165676/H2-Database-Console-Remote-Code-Execution.html
- http://seclists.org/fulldisclosure/2022/Jan/39
- https://github.com/h2database/h2database/releases/tag/version-2.1.210
- https://github.com/h2database/h2database/security/advisories
- https://lists.debian.org/debian-lts-announce/2022/02/msg00017.html
- https://security.netapp.com/advisory/ntap-20230818-0011/
- https://twitter.com/d0nkey_man/status/1483824727936450564
- https://www.debian.org/security/2022/dsa-5076
- https://www.oracle.com/security-alerts/cpuapr2022.html
- https://www.oracle.com/security-alerts/cpujul2022.html
- http://packetstormsecurity.com/files/165676/H2-Database-Console-Remote-Code-Execution.html
- http://seclists.org/fulldisclosure/2022/Jan/39
- https://github.com/h2database/h2database/releases/tag/version-2.1.210
- https://github.com/h2database/h2database/security/advisories
- https://lists.debian.org/debian-lts-announce/2022/02/msg00017.html
- https://security.netapp.com/advisory/ntap-20230818-0011/
- https://twitter.com/d0nkey_man/status/1483824727936450564
- https://www.debian.org/security/2022/dsa-5076
- https://www.oracle.com/security-alerts/cpuapr2022.html
- https://www.oracle.com/security-alerts/cpujul2022.html
