CVE-2024-45758
📋 TL;DR
This vulnerability in H2O.ai H2O allows attackers to set arbitrary JDBC URLs, leading to deserialization attacks, file reads, and remote code execution. Attackers can exploit this by posting malicious JSON to the ImportSQLTable endpoint. All H2O installations through version 3.46.0.4 are affected.
💻 Affected Systems
- H2O.ai H2O
📦 What is this software?
H2o by H2o
⚠️ Risk & Real-World Impact
Worst Case
Full system compromise with unauthenticated remote code execution, allowing attackers to execute arbitrary commands, read sensitive files, and potentially pivot to other systems.
Likely Case
Remote code execution leading to data theft, system compromise, and potential ransomware deployment.
If Mitigated
Limited impact if network segmentation and access controls prevent unauthorized access to the H2O interface.
🎯 Exploit Status
Exploitation requires access to post to the ImportSQLTable URI but does not require authentication.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Not available
Vendor Advisory: Not available
Restart Required: No
Instructions:
No official patch available. Upgrade to a version beyond 3.46.0.4 when released.
🔧 Temporary Workarounds
Network Access Restriction
linuxRestrict network access to H2O instances to only trusted IP addresses.
Use firewall rules to limit access: iptables -A INPUT -p tcp --dport [H2O_PORT] -s [TRUSTED_IP] -j ACCEPT
iptables -A INPUT -p tcp --dport [H2O_PORT] -j DROP
Disable ImportSQLTable Endpoint
allRemove or disable the vulnerable ImportSQLTable endpoint if not needed.
Modify H2O configuration to disable the endpoint or implement reverse proxy rules to block /ImportSQLTable
🧯 If You Can't Patch
- Implement strict network segmentation and firewall rules to isolate H2O instances
- Deploy web application firewall (WAF) rules to block malicious JDBC URL patterns
🔍 How to Verify
Check if Vulnerable:
Check if H2O version is 3.46.0.4 or earlier and if ImportSQLTable endpoint is accessible.Check Version:
Check H2O version via web interface or configuration files.Verify Fix Applied:
Verify H2O version is beyond 3.46.0.4 when patch is released.📡 Detection & Monitoring
Log Indicators:
- POST requests to /ImportSQLTable with JSON containing connection_url
- Unusual JDBC connection attempts or errors
Network Indicators:
- HTTP POST to ImportSQLTable endpoint with JSON payloads
- Outbound connections to unusual JDBC servers
SIEM Query:
source="h2o.log" AND "POST /ImportSQLTable" AND "connection_url"