CVE-2025-10769
📋 TL;DR
This vulnerability in h2oai h2o-3 allows remote attackers to execute arbitrary code through deserialization attacks via the H2 JDBC Driver's connection_url parameter. It affects all systems running h2o-3 versions up to 3.46.08 with the vulnerable component exposed. The exploit can be launched remotely without authentication.
💻 Affected Systems
- h2oai h2o-3
📦 What is this software?
H2o by H2o
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to complete system compromise, data theft, and lateral movement within the network.
Likely Case
Remote code execution with attacker gaining the privileges of the h2o-3 process, potentially leading to data exfiltration or further attacks.
If Mitigated
Exploit blocked at network perimeter or through input validation, resulting in failed attack attempts.
🎯 Exploit Status
Exploit details have been publicly disclosed on GitHub and vulnerability databases. The vendor did not respond to disclosure attempts.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown - vendor did not respond
Vendor Advisory: None available
Restart Required: No
Instructions:
No official patch available. Consider upgrading to latest version if vendor releases fix, or implement workarounds.
🔧 Temporary Workarounds
Network Access Control
allRestrict access to h2o-3 instances, especially the /99/ImportSQLTable endpoint
Input Validation
allImplement strict validation and sanitization of connection_url parameters
🧯 If You Can't Patch
- Isolate h2o-3 instances in restricted network segments with no internet access
- Implement web application firewall (WAF) rules to block malicious connection_url patterns
🔍 How to Verify
Check if Vulnerable:
Check h2o-3 version: if version ≤ 3.46.08 and H2 JDBC Driver is enabled, system is vulnerableCheck Version:
Check h2o-3 documentation or configuration files for version informationVerify Fix Applied:
Verify version is > 3.46.08 or that workarounds are properly implemented📡 Detection & Monitoring
Log Indicators:
- Unusual connection attempts to /99/ImportSQLTable
- Malformed or suspicious connection_url parameters in logs
Network Indicators:
- HTTP requests to /99/ImportSQLTable with crafted connection_url parameters
- Unexpected outbound connections from h2o-3 process
SIEM Query:
source="h2o-3" AND (uri="/99/ImportSQLTable" OR message CONTAINS "connection_url")🔗 References
- https://github.com/ez-lbz/poc/issues/51
- https://github.com/ez-lbz/poc/issues/51#issue-3391023368
- https://huntr.com/bounties/4066ce21-7148-44f5-8336-b1674c2f588d
- https://vuldb.com/?ctiid.325125
- https://vuldb.com/?id.325125
- https://vuldb.com/?submit.649728
- https://vuldb.com/?submit.649793
- https://github.com/ez-lbz/poc/issues/51
- https://github.com/ez-lbz/poc/issues/51#issue-3391023368
- https://huntr.com/bounties/4066ce21-7148-44f5-8336-b1674c2f588d
