Vulnerability record · CVE-2021-42392 · published 10 January 2022
CVE-2021-42392: H2 database JNDI lookup flaw allows unauthenticated remote code execution
H2database · H2
The org.h2.util.JdbcUtils.getConnection method in the H2 database accepts a driver class name and database URL from the caller. An attacker can supply a JNDI driver name and a URL pointing to an LDAP or RMI server, causing the server to load and execute attacker-controlled code. The H2 Console is the most notable vector and is reachable without authentication, making this a critical remote code execution issue.
Description
The org.h2.util.JdbcUtils.getConnection method of the H2 database takes as parameters the class name of the driver and URL of the database. An attacker may pass a JNDI driver name and a URL leading to a LDAP or RMI servers, causing remote code execution. This can be exploited through various attack vectors, most notably through the H2 Console which leads to unauthenticated remote code execution.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Automated analysis
critical priorityCVSS 9.8 with no authentication or user interaction required, unauthenticated RCE via the H2 Console, and a very high EPSS score with public exploit detail.
What it is
The org.h2.util.JdbcUtils.getConnection method in the H2 database accepts a driver class name and database URL from the caller. An attacker can supply a JNDI driver name and a URL pointing to an LDAP or RMI server, causing the server to load and execute attacker-controlled code. The H2 Console is the most notable vector and is reachable without authentication, making this a critical remote code execution issue.
Impact
An attacker gains remote code execution in the context of the process running H2, which can lead to full host compromise, data theft or lateral movement. No privileges are required on the target.
Attack surface
Reachable over the network via the H2 Console or any other interface that passes attacker-controlled driver names and URLs into JdbcUtils.getConnection. The CVSS vector shows no authentication and no user interaction required.
Exploitation
Not listed in CISA KEV, but EPSS is 0.63211 (99th percentile) and references include an exploit-tagged JFrog technical writeup, indicating public exploitation detail exists. No ransomware association is documented.
What to do
- Upgrade H2 to a version that blocks JNDI-based driver loading, per the vendor security advisory GHSA-h376-j262-vhq6.
- Apply the Oracle CPU April 2022 and Debian DSA-5076 updates where H2 is bundled or packaged.
- Disable or restrict network access to the H2 Console; do not expose it to untrusted networks.
- Run H2 with least privilege and restrict outbound LDAP/RMI traffic from hosts running H2.
- Audit applications that embed H2 for user-controlled JDBC URL or driver name input.
Detection
- Monitor H2 Console access logs for requests supplying driver or URL parameters containing ldap:// or rmi:// schemes.
- Alert on outbound LDAP or RMI connections originating from hosts that run H2.
- Look for JNDI-related class loading or unexpected child processes spawned by Java processes hosting H2.
- Search application logs for JdbcUtils.getConnection errors or stack traces referencing JNDI driver names.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Affected products
3 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
Track CVE-2021-42392 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2021-42392), CISA KEV, FIRST EPSS (scores of 2026-09-24). This page is refreshed as NVD updates the record.
