Executive Summary

This vulnerability in the h2oai/h2o-3 repository allows attackers to exploit deserialization of untrusted data by bypassing regular expression filters that validate JDBC connection parameters. Attackers manipulate spaces between parameters in key-value pairs to evade detection, enabling them to inject dangerous parameters like 'autoDeserialize' that can lead to arbitrary code execution and unauthorized reading of system files. The issue was fixed by improving the validation logic to correctly identify and block such dangerous parameters regardless of spacing or casing. [1]

Useful 0 Not Useful 0

Impact Analysis

If exploited, this vulnerability can allow attackers to execute arbitrary code on the affected system and read sensitive system files without authorization. This can lead to full system compromise, data breaches, and unauthorized access to confidential information. [1]

Useful 0 Not Useful 0

Detection Guidance

You can detect this vulnerability by inspecting JDBC connection strings used in your H2O-3 deployment for the presence of dangerous parameters such as 'autoDeserialize', 'queryInterceptors', 'allowLoadLocalInfile', and 'allowMultiQueries'. Since the vulnerability involves bypassing regular expression filters by manipulating spaces around parameters, look for key-value pairs in JDBC URLs that include these parameters with varying casing and spacing. Commands to help detect this could include searching configuration files or logs for these parameters, for example using grep: `grep -iE 'autoDeserialize|queryInterceptors|allowLoadLocalInfile|allowMultiQueries' /path/to/configs/*` or scanning running processes for JDBC URLs containing these parameters. Additionally, reviewing logs or network traffic for suspicious JDBC connection strings might help identify exploitation attempts. [1]

Useful 0 Not Useful 0

Mitigation Strategies

The immediate mitigation step is to upgrade your H2O-3 platform to version 3.46.0.8 or later, where the vulnerability is fixed by improved validation of JDBC connection parameters. This update enhances the regular expression parsing to correctly identify and block dangerous parameters even if they include spaces or different casing. Until you can upgrade, ensure that JDBC connection strings do not include dangerous parameters such as 'autoDeserialize', 'queryInterceptors', 'allowLoadLocalInfile', and 'allowMultiQueries'. Additionally, restrict access to configuration files and monitor for suspicious JDBC parameter usage to reduce risk. [1]

Useful 0 Not Useful 0