CVE-2025-6544
📋 TL;DR
A critical deserialization vulnerability in h2oai/h2o-3 allows attackers to bypass security checks using double URL encoding, enabling arbitrary file reading and remote code execution. All users running h2o-3 versions 3.46.0.8 and earlier are affected by this vulnerability.
💻 Affected Systems
- h2oai/h2o-3
📦 What is this software?
H2o by H2o
⚠️ Risk & Real-World Impact
Worst Case
Full system compromise with attacker gaining root/system privileges, data exfiltration, and persistent backdoor installation
Likely Case
Arbitrary file reading leading to credential theft and subsequent lateral movement within the network
If Mitigated
Limited impact if network segmentation and strict access controls prevent exploitation attempts
🎯 Exploit Status
Exploit details available in public bounty reports; double URL encoding bypass makes exploitation straightforward
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 3.46.0.9 or later
Vendor Advisory: https://github.com/h2oai/h2o-3/commit/0298ee348f5c73673b7b542158081e79605f5f25
Restart Required: Yes
Instructions:
1. Upgrade to h2o-3 version 3.46.0.9 or later. 2. Stop the h2o-3 service. 3. Replace the existing installation with patched version. 4. Restart the service.
🔧 Temporary Workarounds
Network Access Restriction
linuxBlock external access to h2o-3 service ports
iptables -A INPUT -p tcp --dport [h2o-port] -j DROP
firewall-cmd --permanent --add-rich-rule='rule family="ipv4" source address="0.0.0.0/0" port port="[h2o-port]" protocol="tcp" reject'
JDBC Connection Disable
allDisable JDBC functionality if not required
Set environment variable: export H2O_DISABLE_JDBC=true
Add to h2o config: -disable_jdbc
🧯 If You Can't Patch
- Implement strict network segmentation to isolate h2o-3 instances from sensitive systems
- Deploy WAF rules to detect and block double URL encoding patterns in JDBC connection requests
🔍 How to Verify
Check if Vulnerable:
Check h2o-3 version: if version <= 3.46.0.8, system is vulnerableCheck Version:
java -jar h2o.jar --versionVerify Fix Applied:
Confirm version is 3.46.0.9 or later and test JDBC connection with double-encoded payloads📡 Detection & Monitoring
Log Indicators:
- Multiple URL encoding patterns in JDBC connection strings
- Unusual file access patterns from h2o process
- Java deserialization errors in logs
Network Indicators:
- HTTP requests with double-encoded %25 patterns to h2o endpoints
- Unexpected outbound connections from h2o service
SIEM Query:
source="h2o.log" AND ("%25%25" OR "JDBC" OR "deserialization")