PT-2021-8014 · H2Database · H2

Threedr3Am · Published 2021-12-10 · Updated 2023-08-18 · CVE-2021-23463

Positive Technologies (AI Summary)

CVSS v2.0

8.5

High

Base vector

AV:N/AC:L/Au:S/C:C/I:N/A:C

Name of the Vulnerable Software and Affected Versions com.h2database:h2 versions 1.4.198 through 2.0.202

Description The issue is related to XML External Entity (XXE) Injection via the org.h2.jdbc.JdbcSQLXML class object. This occurs when the object receives parsed string data from the org.h2.jdbc.JdbcResultSet.getSQLXML() method and executes the getSource() method with the parameter DOMSource.class. The vulnerability allows a remote attacker to conduct XXE attacks due to incorrect restriction of XML external entity references.

Recommendations For versions 1.4.198 through 2.0.202, consider disabling the org.h2.jdbc.JdbcSQLXML class object or restricting its use until a patch is available. As a temporary workaround, avoid using the getSource() method with the parameter DOMSource.class to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

XXE

Weakness Enumeration

CWE-611

Related Identifiers

BDU:2024-02259

CVE-2021-23463

GHSA-7RPJ-HG47-CX62

SNYK-JAVA-COMH2DATABASE-1769238

Affected Products

H2

References · 15

• 🔥 https://github.com/h2database/h2database/issues/3195 · Exploit
• 🔥 https://snyk.io/vuln/SNYK-JAVA-COMH2DATABASE-1769238 · Exploit
• https://github.com/h2database/h2database/pull/3199 · Patch
• https://osv.dev/vulnerability/GHSA-7rpj-hg47-cx62 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-23463 · Security Note
• https://osv.dev/vulnerability/CVE-2021-23463 · Vendor Advisory
• https://bdu.fstec.ru/vul/2024-02259 · Security Note
• https://github.com/h2database/h2database · Note
• https://github.com/h2database/h2database/commit/d83285fd2e48fb075780ee95badee6f5a15ea7f8%23diff-008c2e4462609982199cd83e7cf6f1d6b41296b516783f6752c44b9f15dc7bc3 · Note
• https://github.com/h2database/h2database/pull/3199#issuecomment-1002830390 · Note
• https://security.netapp.com/advisory/ntap-20230818-0010 · Note
• https://github.com/boris-unckel/h2database/commit/f9ad6aef2bfa59eba2b4d3e7c4c32d2cce8e8b05 · Note
• https://oracle.com/security-alerts/cpuapr2022.html · Note
• https://t.me/cibsecurity/33764 · Telegram Post
• https://access.redhat.com/security/cve/CVE-2021-23463 · Note