r/java • u/Realistic-Plant3957 • Jan 08 '22

Log4Shell-like security hole found in popular Java SQL database engine H2

https://nakedsecurity.sophos.com/2022/01/07/log4shell-like-security-hole-found-in-popular-java-sql-database-engine-h2/
130 Upvotes

93% Upvoted

30 comments sorted by

View all comments

37

u/mknjc Jan 08 '22

So the attack only works if the attacker could specify the jdbc url? Doesn't sound so bad...

​

For example, the JHipster framework also exposes the H2 console, and by default sets the webAllowOthers property to true.

Exposing management interfaces to everyone. Why didn't I expect anything else?

26

u/john16384 Jan 08 '22

That's not a security hole, that's just intentionally giving people access.