H2O.ai H2O through 3.46.0.4 allows attackers to arbitrarily set the JDBC URL, leading to deserialization attacks, file reads, and command execution. Exploitation can occur when an attacker has access to post to the ImportSQLTable URI with a JSON document containing a connection_url property with any typical JDBC Connection URL attack payload such as one that uses queryInterceptors.
An attacker sends an HTTP POST request to the ImportSQLTable endpoint, providing a JSON document containing the connection_url property with an arbitrary malicious JDBC Connection URL — for example, one that leverages the queryInterceptors mechanism. The H2O platform does not verify or restrict the value of this parameter, allowing the connection to be directed to an attacker-controlled server or using deserialization payloads. As a result of processing the crafted URL, deserialization of untrusted data occurs (CWE-502), enabling arbitrary code execution or file read from the server.
An attacker can gain full control over the server through remote code execution (RCE) and read arbitrary files accessible from the application process level. Complete compromise of system confidentiality and integrity is possible.
Apply patches available from the vendor according to references. Temporarily, it is recommended to restrict access to the ImportSQLTable endpoint at the firewall level or through authentication mechanisms to prevent unauthorized users from sending POST requests to this URI.
H2O.ai H2O in versions up to and including 3.46.0.4
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:NH2o
APPH2O≤ 3.46.0.4
Related vulnerabilities
RCE przez obejście blacklisty JDBC w REST API H2O-3
Deserializacja w H2O umożliwia RCE i odczyt plików systemowych
RCE poprzez deserializację w REST API h2oai/h2o-3 (JDBC URL)
RCE w H2O poprzez funkcję importu modelu POJO
h2o HTTP/2: amplifikacja stanu HPACK + atak Slowloris na strumienie