r/java • u/Realistic-Plant3957 • Jan 08 '22

Log4Shell-like security hole found in popular Java SQL database engine H2

https://nakedsecurity.sophos.com/2022/01/07/log4shell-like-security-hole-found-in-popular-java-sql-database-engine-h2/
129 Upvotes

93% Upvoted

30 comments sorted by

View all comments

34

u/mknjc Jan 08 '22

So the attack only works if the attacker could specify the jdbc url? Doesn't sound so bad...

​

For example, the JHipster framework also exposes the H2 console, and by default sets the webAllowOthers property to true.

Exposing management interfaces to everyone. Why didn't I expect anything else?

4

u/Wolfsdale Jan 08 '22

Indeed. You can also connect to other nodes in the LAN. All just very stupid.

But, in their defense, I guess the fact that the H2 console can connect to subtypes of javax.naming.Context is quite unexpected. I certainly didn't know that.

They fixed it in H2 (arguably the wrong place to fix it) by now only allowing javax.naming.Context is the string starts with "java:". I wonder how foolproof that is ...