CVE-2018-10054
HIGHDatomic < 0.9.5697 - Remote Code Execution via H2 CREATE ALIAS
Title source: manualExploitation Summary
EIP tracks 2 public exploits for CVE-2018-10054.
PoCs published by gambler, h00die, gambler, h4ckNinja, Nairuz Abulhul, including Metasploit module exploits/linux/http/h2_webinterface_rce.
AI-analyzed exploit summary This exploit abuses H2 Database's alias functionality to create a custom Java function that executes arbitrary commands, leading to remote code execution (RCE). It automates the process of logging in, creating the malicious alias, and executing commands via SQL queries.
Description
H2 1.4.197, as used in Datomic before 0.9.5697 and other products, allows remote code execution because CREATE ALIAS can execute arbitrary Java code. NOTE: the vendor's position is "h2 is not designed to be run outside of a secure environment."
Exploits (2)
This exploit abuses H2 Database's alias functionality to create a custom Java function that executes arbitrary commands, leading to remote code execution (RCE). It automates the process of logging in, creating the malicious alias, and executing commands via SQL queries.
This Metasploit module exploits a feature in H2 Database's web interface to execute arbitrary Java code via the CREATE ALIAS function, leading to remote command execution. It uses a multi-step approach involving payload retrieval via curl and execution on the target system.
References (10)
Scores
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H