CVE-2025-6507
BaseFortify
Publication date: 2025-09-01
Last updated on: 2025-09-02
Assigner: huntr.dev
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| h2oai | h2o-3 | 3.46.0.8 |
| h2oai | h2o-3 | 3.47.0.99999 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-502 | The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability in the h2oai/h2o-3 repository allows attackers to exploit deserialization of untrusted data by bypassing regular expression filters that validate JDBC connection parameters. Attackers manipulate spaces between parameters in key-value pairs to evade detection, enabling them to inject dangerous parameters like 'autoDeserialize' that can lead to arbitrary code execution and unauthorized reading of system files. The issue was fixed by improving the validation logic to correctly identify and block such dangerous parameters regardless of spacing or casing. [1]
How can this vulnerability impact me? :
If exploited, this vulnerability can allow attackers to execute arbitrary code on the affected system and read sensitive system files without authorization. This can lead to full system compromise, data breaches, and unauthorized access to confidential information. [1]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
You can detect this vulnerability by inspecting JDBC connection strings used in your H2O-3 deployment for the presence of dangerous parameters such as 'autoDeserialize', 'queryInterceptors', 'allowLoadLocalInfile', and 'allowMultiQueries'. Since the vulnerability involves bypassing regular expression filters by manipulating spaces around parameters, look for key-value pairs in JDBC URLs that include these parameters with varying casing and spacing. Commands to help detect this could include searching configuration files or logs for these parameters, for example using grep: `grep -iE 'autoDeserialize|queryInterceptors|allowLoadLocalInfile|allowMultiQueries' /path/to/configs/*` or scanning running processes for JDBC URLs containing these parameters. Additionally, reviewing logs or network traffic for suspicious JDBC connection strings might help identify exploitation attempts. [1]
What immediate steps should I take to mitigate this vulnerability?
The immediate mitigation step is to upgrade your H2O-3 platform to version 3.46.0.8 or later, where the vulnerability is fixed by improved validation of JDBC connection parameters. This update enhances the regular expression parsing to correctly identify and block dangerous parameters even if they include spaces or different casing. Until you can upgrade, ensure that JDBC connection strings do not include dangerous parameters such as 'autoDeserialize', 'queryInterceptors', 'allowLoadLocalInfile', and 'allowMultiQueries'. Additionally, restrict access to configuration files and monitor for suspicious JDBC parameter usage to reduce risk. [1]