Vulnerability record · CVE-2022-23221 · published 19 January 2022
CVE-2022-23221: H2 Console JDBC URL argument injection enables remote code execution
H2database · H2
H2 Console before 2.1.210 accepts a jdbc:h2:mem JDBC URL containing the IGNORE_UNKNOWN_SETTINGS=TRUE;FORBID_CREATION=FALSE;INIT=RUNSCRIPT substring, which lets an attacker inject arguments that trigger script execution. It is a distinct flaw from CVE-2021-42392 and matters because the console is remotely reachable and the injected INIT clause runs attacker-supplied SQL. The record does not list specific affected versions beyond the pre-2.1.210 boundary.
Description
H2 Console before 2.1.210 allows remote attackers to execute arbitrary code via a jdbc:h2:mem JDBC URL containing the IGNORE_UNKNOWN_SETTINGS=TRUE;FORBID_CREATION=FALSE;INIT=RUNSCRIPT substring, a different vulnerability than CVE-2021-42392.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Automated analysis
critical priorityUnauthenticated remote code execution with CVSS 9.8, public exploit references and a very high EPSS score, though not yet in KEV.
What it is
H2 Console before 2.1.210 accepts a jdbc:h2:mem JDBC URL containing the IGNORE_UNKNOWN_SETTINGS=TRUE;FORBID_CREATION=FALSE;INIT=RUNSCRIPT substring, which lets an attacker inject arguments that trigger script execution. It is a distinct flaw from CVE-2021-42392 and matters because the console is remotely reachable and the injected INIT clause runs attacker-supplied SQL. The record does not list specific affected versions beyond the pre-2.1.210 boundary.
Impact
An unauthenticated remote attacker can execute arbitrary code in the context of the H2 Console process, giving full control of the host running it. CVSS 3.1 scores this 9.8 with high confidentiality, integrity and availability impact.
Attack surface
Reached over the network via the H2 Console interface, per the AV:N vector, with no authentication or user interaction required (PR:N, UI:N). The attacker supplies the crafted JDBC URL to the console.
Exploitation
Not listed in CISA KEV, but EPSS 30-day probability is 0.64766 (99.2nd percentile) and multiple references carry Exploit tags, indicating public exploit material exists. No ransomware group usage is documented in the record.
What to do
- Upgrade H2 to 2.1.210 or later, which is the version referenced by the patch release notes.
- Apply vendor patches for downstream products that bundle H2, including Debian DSA-5076 and Oracle CPU April 2022 advisories.
- Do not expose the H2 Console to untrusted networks; restrict it to localhost or a management network.
- Disable or remove the H2 Console web servlet where it is not operationally required.
- Block or reject JDBC URLs containing INIT, RUNSCRIPT, IGNORE_UNKNOWN_SETTINGS or FORBID_CREATION parameters at any input boundary.
Detection
- Search application and proxy logs for JDBC URLs containing INIT=RUNSCRIPT, IGNORE_UNKNOWN_SETTINGS=TRUE or FORBID_CREATION=FALSE.
- Monitor H2 Console access logs for requests from unexpected or external source addresses.
- Alert on child processes spawned by the Java process hosting H2 Console, especially shell or script interpreters.
- Audit deployed H2 jar versions and flag any below 2.1.210.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Affected products
3 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
Track CVE-2022-23221 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2022-23221), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.
