Be-Innova/CVE-2021-42392-exploit-lab

GitHubRepository PoC

PoC files

7 files

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

GitHub

Docker lab environments

1
GitHub

docker-compose.yml

Created Vuln labCVE-2021-42392Compose · builds

1 Compose manifest · 2 Dockerfiles · 2 services

Analysisdeepseek-v4-pro:cloud ·

Environment assessment

A Docker Compose environment with two services: a vulnerable H2 database server (version 2.0.202) and a client container with a Python exploit script targeting CVE-2021-42392.

docker-compose.yml:1-15README.md:1-91

Lab assessment

Vulnerability lab

The README explicitly states the repository provides a minimal environment to test CVE-2021-42392, and the included Dockerfiles and exploit script are designed to demonstrate the vulnerability.

README.md:1-3
Lab shapeCompose · builds
Services2
Compose manifests1
Dockerfiles2
Evidence & reasoningComponents · CVE assessment · exercise context · review boundaries
Components

Services and files described by the evidence

h2

vulnerable target

Alpine-based container running H2 Database 2.0.202 via TCP on port 9092, started by start.sh with options -tcp -tcpAllowOthers -tcpPort 9092 -ifNotExists.

h2/Dockerfile:1-16h2/start.sh:1-3docker-compose.yml:4-8

client

exploit launcher

Python 3.11-slim container with jaydebeapi, JPype1, and a script (h2_exploit.py) that connects to the H2 service and executes CREATE ALIAS to achieve RCE.

client/Dockerfile:1-16client/h2_exploit.py:1-52docker-compose.yml:10-15
CVE assessment

How the supplied evidence relates each vulnerability

CVE-2021-42392

Supported by supplied evidence

The exploit script uses CREATE ALIAS to execute arbitrary commands on the H2 server, matching the CVE description. The README and Dockerfiles confirm the vulnerable version 2.0.202 is used.

client/h2_exploit.py:36-46h2/Dockerfile:9README.md:9-11
Exercise context

Requirements and sequence described by the evidence

Prerequisites

  • Docker and Docker Compose installed on the host.README.md:21-23
  • The H2 service must be running and accessible on port 9092 (default credentials sa / empty password).client/h2_exploit.py:22-24docker-compose.yml:6
  • The H2 JAR file must be present at /jars/h2.jar in the client container.client/Dockerfile:10-11client/h2_exploit.py:12

Evidence-described exercise path

  1. Build and start the containers with 'docker compose build' and 'docker compose up -d'.README.md:33-35
  2. Execute a shell in the client container: 'docker compose exec client bash'.README.md:39
  3. Run the exploit script with the JDBC URL, command, and JAR path, e.g., 'python3 h2_exploit.py --url jdbc:h2:tcp://h2-vulnerable:9092/~/test --cmd "touch /tmp/pwned" --jar /jars/h2.jar'.README.md:41client/h2_exploit.py:1-52
Safety-review evidence

Behaviors behind the stored safety assessment

No harmful behavior observed

All visible behavior is confined to the lab containers: the exploit targets the vulnerable H2 service within the same Docker network, and no host escape, external connections, persistence, or credential theft is observed.

docker-compose.yml:1-15client/h2_exploit.py:1-52h2/start.sh:1-3
Review boundaries

What the analysis did not establish

  • The file client/h2-2.2.224.jar is a binary and was not inspected; its behavior is unknown.
  • The README mentions a requirement for 'javac' compiler on the server running the vulnerable database, but the provided h2 container does not install a JDK (only JRE), which may affect exploitability in other environments but is not relevant to the lab's own exercise.
Model interpretation

This review is limited to the supplied lab evidence packet. It does not assert that the environment runs, reproduces a vulnerability, or is safe to execute. Contract: eip-docker-lab-analysis-v1.

Linked vulnerabilities

1