AIKIDO-2024-10414
h2o is vulnerable to Deserialization of Untrusted Data
92
Critical Risk
This Affects:
h2oTL;DR
Affected versions of this package are vulnerable to unauthenticated Remote Code Execution (RCE) via an unrestricted JDBC connection. Despite the intention to use the getConnectionSafe method for secure connections, no restrictions are imposed on the JDBC connection settings. This allows attackers to arbitrarily set the JDBC URL, potentially leading to deserialization attacks, file reading, command execution, and other severe security risks on the victim's server.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range.
Background info
h2o is vulnerable to Deserialization of Untrusted Data in versions 3.10.0.3 - 3.46.0.5.
How to fix this
Upgrade the h2o library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
SOC 2Compliant
ISO 27001Compliant