CVE-2024-45758

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-45758
H2O.ai H2O through 3.46.0.4 allows attackers to arbitrarily set the JDBC URL, leading to deserialization attacks, file reads, and command execution. Exploitation can occur when an attacker has access to post to the ImportSQLTable URI with a JSON document containing a connection_url property with any typical JDBC Connection URL attack payload such as one that uses queryInterceptors.

9.1 /10

CVSS v3 : CRITICAL

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 5.2

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
https://gist.github.com/AfterSnows/c24ca3c26dc89ab797e610e92a6a9acb Third Party Advisory
https://spear-shield.notion.site/Unauthenticated-Remote-Code-Execution-via-Unrestricted-JDBC-Connection-87a958a4874044199cbb86422d1f6068 Exploit Third Party Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:h2o:h2o:*:*:*:*:*:*:*:*
History

29 Sep 2025, 13:56

Type Values Removed Values Added
First Time H2o
H2o h2o
References () https://gist.github.com/AfterSnows/c24ca3c26dc89ab797e610e92a6a9acb - () https://gist.github.com/AfterSnows/c24ca3c26dc89ab797e610e92a6a9acb - Third Party Advisory
References () https://spear-shield.notion.site/Unauthenticated-Remote-Code-Execution-via-Unrestricted-JDBC-Connection-87a958a4874044199cbb86422d1f6068 - () https://spear-shield.notion.site/Unauthenticated-Remote-Code-Execution-via-Unrestricted-JDBC-Connection-87a958a4874044199cbb86422d1f6068 - Exploit, Third Party Advisory
CPE cpe:2.3:a:h2o:h2o:*:*:*:*:*:*:*:*
Summary
  • (es) H2O.ai H2O hasta la versión 3.46.0.4 permite a los atacantes configurar arbitrariamente la URL de JDBC, lo que genera ataques de deserialización, lectura de archivos y ejecución de comandos. La explotación puede ocurrir cuando un atacante tiene acceso para publicar en la URL ImportSQLTable con un documento JSON que contiene una propiedad connection_url con cualquier payload típico de ataque de URL de conexión de JDBC, como una que utiliza queryInterceptors.

06 Sep 2024, 18:35

Type Values Removed Values Added
CWE CWE-502
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 9.1

06 Sep 2024, 16:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-09-06 16:15

Updated : 2025-09-29 13:56

NVD link : CVE-2024-45758

Mitre link : CVE-2024-45758

CVE.ORG link : CVE-2024-45758

JSON object : View

Products Affected

h2o

  • h2o
CWE
CWE-502

Deserialization of Untrusted Data