[ad_1]
Researchers have disclosed a safety flaw affecting H2 database consoles that would end in distant code execution in a fashion that echoes the Log4j “Log4Shell” vulnerability that got here to gentle final month.
The problem, tracked as CVE-2021-42392, is the ” first essential difficulty revealed since Log4Shell, on a part aside from Log4j, that exploits the identical root reason behind the Log4Shell vulnerability, particularly JNDI distant class loading,” JFrog researchers Andrey Polkovnychenko and Shachar Menashe stated.
H2 is an open-source relational database administration system written in Java that may be embedded inside functions or run in a client-server mode. In accordance with the Maven Repository, the H2 database engine is utilized by 6,807 artifacts.
JNDI, brief for Java Naming and Listing Interface, refers to an API that gives naming and listing performance for Java functions, which might use the API along side LDAP to find a particular useful resource that it’d want.
Within the case of Log4Shell, this characteristic permits runtime lookups to servers, each inside and outdoors the community, which, in flip, could be weaponized to permit unauthenticated distant code execution and implant malware on the server by crafting a malicious JNDI lookup as enter to any Java utility that makes use of susceptible variations of the Log4j library to log it.
“Much like the Log4Shell vulnerability uncovered in early December, attacker-controlled URLs that propagate into JNDI lookups can permit unauthenticated distant code execution, giving attackers sole management over the operation of one other particular person or group’s techniques,” Menashe, senior director of JFrog safety analysis, defined.
The flaw impacts H2 database variations 1.1.100 to 2.0.204 and has been addressed in model 2.0.206 shipped on January 5, 2022.
“The H2 database is utilized by many third-party frameworks, together with Spring Boot, Play Framework and JHipster,” Menashe added. “Whereas this vulnerability is just not as widespread as Log4Shell, it may nonetheless have a dramatic impression on builders and manufacturing techniques if not addressed accordingly.”
[ad_2]
