JDBC deserialization vulnerability in H2O-3
H2O-3 had a JDBC deserialization vulnerability (CVE-2024-10553) that could allow remote code execution through unsafe database connection parameters. H2O.ai patched the issue by implementing parameter validation to block dangerous JDBC settings.
What happened
CVE-2024-10553 identified a JDBC deserialization vulnerability in H2O-3 that could be exploited through unsafe JDBC parameters in database connection URLs.
The vulnerability allowed attackers to potentially execute arbitrary code by manipulating parameters such as autoDeserialize, queryInterceptors, allowLoadLocalInfile, and others across MySQL and H2 database drivers.
H2O.ai patched the vulnerability by implementing JDBC parameter validation in the SQLManager class, disallowing a default list of dangerous parameters including autoDeserialize, queryInterceptors, allowLoadLocalInfile, allowMultiQueries, allowLoadLocalInfileInPath, allowUrlInLocalInfile, allowPublicKeyRetrieval, init, script, and shutdown.
Governance controls
The fix added validation logic to the importSqlTable method that checks JDBC connection URLs against a configurable list of disallowed parameters.
A system property was introduced to allow customization of the blocked parameter list, providing flexibility for deployments with specific requirements.
Classification
Sources and evidence
Sources not yet published
This record was researched and written by the Index from original reporting. Its sources are still being verified by an editor, and they are listed here once that check is complete. Until then the record carries no reviewer.