CVE-2018-10054

Vulnerability

H2 database version 1.4.197, as used in Datomic before 0.9.5697 and other products, allows remote code execution through the CREATE ALIAS feature, which can execute arbitrary Java code [1]. The web console, by default, does not require authentication, making this attack vector accessible to anyone with network access [2].

Exploitation

An attacker needs network access to the H2 web console (typically on port 8082). No authentication is required by default. The attacker can log in and execute SQL commands: CREATE ALIAS SHELLEXEC AS $$ String shellexec(String cmd) throws java.io.IOException { ... } $$; followed by CALL SHELLEXEC('command') to execute arbitrary system commands [2].

Impact

Successful exploitation results in remote code execution with the privileges of the H2 database process. This can lead to full system compromise, including data exfiltration, installation of malware, or lateral movement within the network [2].

Mitigation

The vendor's position is that H2 is not designed for untrusted environments [1]. Mitigations include setting a strong password for the database, restricting access to the web console to localhost only, or disabling the web console entirely [3]. Datomic fixed the issue in version 0.9.5697 [1]. No CISA KEV listing exists. As of now, no official patch from H2 is available because the behavior is considered a feature, not a bug.