Horizon Alert
Summary of the vulnerability and why it matters
This critical vulnerability allows unauthenticated attackers to execute arbitrary code on the H2O-3 server. The issue stems from weak security controls in an API endpoint that can be bypassed by manipulating JDBC parameters. This could lead to a complete compromise of the server.
- Arbitrary code execution on the server.
- Affects unauthenticated users.
- Commonly exposed via the internet.
Attack Path
How an attacker could exploit the issue
An attacker can exploit this vulnerability by sending a specially crafted request to the unauthenticated `/99/ImportSQLTable` endpoint on an H2O-3 server. By manipulating JDBC parameters, the attacker can trick the server into executing arbitrary code with the privileges of the H2O-3 process. This bypasses the application's intended security checks, allowing for full system compromise.
- Unauthenticated API access required.
- Targets H2O-3 `ImportSQLTable` endpoint.
- Bypasses parameter blacklist.
Live Threat
Current exploitation, exposure, and threat context
The current threat landscape suggests this critical vulnerability could be attractive to attackers. Exploiting an unauthenticated REST API endpoint with the potential for remote code execution is a direct path to compromising systems. The bypass mechanism involving JDBC URL manipulation indicates a sophisticated attack vector, which may deter less skilled actors but appeal to determined ones.
- Exploits unauthenticated API endpoint.
- Remote code execution capability.
- Vulnerable versions are older.
Priority actions
Operational Fix
Recommended remediation, mitigation, and detection steps
Prioritize blocking traffic to the `/99/ImportSQLTable` endpoint and upgrading H2O-3 to version 3.46.0.10 immediately. Given the critical severity and unauthenticated nature of this remote code execution vulnerability, actively exploited, or having a reliable public exploit, isolate or take affected services offline if patching is not feasible.
- Upgrade H2O-3 to 3.46.0.10.
- Block `/99/ImportSQLTable` API access.
- Monitor for exploitation attempts.
