H2 Database JNDI Lookup RCE

CVE-2021-42392 is a JNDI-based remote code execution flaw in H2 Console affecting H2 versions 1.1.100 through 2.0.204, fixed in 2.0.206. An attacker can abuse the console login form by supplying a JNDI driver such as javax.naming.InitialContext and an attacker-controlled url like ldap://..., which reaches org.h2.util.JdbcUtils.getConnection() before credentials are meaningfully validated. The most dangerous path is the web console; there are also SQL-based paths, but those require ADMIN privileges and are basically post-compromise.

The vendor/NVD CRITICAL 9.8 rating is technically understandable but operationally inflated for most enterprises. The big friction point is that H2 Console is localhost-only by default and many H2 deployments are embedded or dev/test-only, so the reachable population is far smaller than the CVSS vector implies; however, any instance that is reachable from user subnets or the internet is still a serious unauthenticated RCE with public weaponization patterns and easy scanability.

Why this verdict

• Downgrade for default-safe posture: vanilla H2 Console does not accept remote connections by default, so the vendor 9.8 assumes a reachable surface that many deployments simply do not expose.
• Downgrade for attacker position requirements in practice: the clean unauthenticated path usually requires user-subnet or internet reachability to an admin/dev console. If it is only reachable internally, the bug is already post-initial-access and loses urgency relative to perimeter RCEs.
• Downgrade for exposure fraction: H2 is popular as an embedded library, but the exploitable path is specifically the console or another context that forwards attacker-controlled JNDI parameters. That is a much smaller population than 'all H2 on the classpath.'
• Keep it HIGH because exploitation is straightforward once reachable: no auth is needed on the console path, public technical detail exists, scanning is easy, and successful exploitation gives code execution in the application process.
• Keep it HIGH because developer tooling is a soft target: JFrog called out ecosystems like JHipster and developer-oriented deployments where webAllowOthers or /h2-console exposure shows up more often than it should.

Why not higher?

I am not calling this CRITICAL because the most important prerequisite is not the version number, it is console exposure. A bug that needs an otherwise-nondefault admin surface to be remotely reachable is not in the same operational bucket as Exchange, vCenter, or edge-device RCEs that are commonly internet-facing by design. Mixed evidence on live exploitation also keeps this below the top bucket.

Why not lower?

I am not dropping this to MEDIUM because exposed instances are one-request pre-auth RCE with full node compromise potential. If your attack surface scan shows even a handful of reachable H2 consoles, this immediately stops being theoretical and deserves fast handling.

1. Block remote access to H2 Console — Remove external and broad internal reachability to H2 Console endpoints and standalone ports, especially 8082 and framework paths like /h2-console. For a HIGH verdict, deploy this within 30 days; if you already know an instance is internet-exposed, do it in the first change window, not at day 29.
2. Disable webAllowOthers — Set webAllowOthers=false or remove the flag entirely so vanilla H2 stays localhost-only. Apply within 30 days because this is the single configuration change that kills the main unauthenticated path without waiting for a full application rebuild.
3. Require authz at the servlet layer — If the console must exist temporarily, wrap the H2 servlet behind a proper security constraint or reverse-proxy access control limited to named admins and trusted jump hosts. Deploy within 30 days as a containment measure for apps that cannot be rebuilt immediately.
4. Restrict outbound LDAP/RMI — Block unnecessary egress from application servers to LDAP, RMI, and arbitrary high-risk destinations. This does not fully solve the bug, but within 30 days it meaningfully raises exploit friction by breaking the common JNDI callback stage.
5. Harden the Java runtime — Ensure runtimes are on JRE/JDK lines where trustURLCodebase protections are on by default (6u211, 7u201, 8u191, 11.0.1+ per JFrog). Do this within 30 days as defense-in-depth, not as a substitute for fixing H2.

Run this on the target host or on an auditor workstation with filesystem access to the application directories. Invoke it as python3 verify_h2_cve_2021_42392.py /opt /srv /app with read access only; root/admin is not required unless your app directories are restricted. The script looks for H2 jars, extracts versions, and searches nearby config files for exposure indicators such as webAllowOthers=true or spring.h2.console.enabled=true.

#!/usr/bin/env python3
# verify_h2_cve_2021_42392.py
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN, 3=usage/error

import os
import re
import sys
from pathlib import Path

MAX_FILES = 25000
MAX_FILE_SIZE = 2 * 1024 * 1024
CONFIG_EXTS = {'.properties', '.yml', '.yaml', '.xml', '.conf', '.cfg', '.ini', '.json', '.sh', '.bat', '.cmd', '.ps1'}

VULN_MIN = (1, 1, 100)
FIXED = (2, 0, 206)

jar_hits = []
exposure_hits = []
scanned = 0

version_patterns = [
    re.compile(r'h2[-_](\d+)\.(\d+)\.(\d+)\.jar$', re.I),
    re.compile(r'/com/h2database/h2/(\d+)\.(\d+)\.(\d+)/h2-\1\.\2\.\3\.jar$', re.I),
    re.compile(r'\bversion\b\s*[:=]\s*["\']?(\d+)\.(\d+)\.(\d+)["\']?', re.I),
]

indicator_patterns = [
    re.compile(r'\bwebAllowOthers\s*=\s*true\b', re.I),
    re.compile(r'\b-webAllowOthers\b', re.I),
    re.compile(r'\bspring\.h2\.console\.enabled\s*[:=]\s*true\b', re.I),
    re.compile(r'\bspring\.h2\.console\.path\s*[:=]\s*/h2-console\b', re.I),
    re.compile(r'\b/h2-console\b', re.I),
    re.compile(r'Server\.createWebServer\([^\)]*-webAllowOthers', re.I),
]


def parse_ver_tuple(text):
    for pat in version_patterns:
        m = pat.search(text)
        if m:
            return tuple(int(x) for x in m.groups())
    return None


def ver_lt(a, b):
    return a < b


def ver_gte(a, b):
    return a >= b


def is_vuln_version(v):
    return ver_gte(v, VULN_MIN) and ver_lt(v, FIXED)


def scan_file(path):
    global scanned
    if scanned >= MAX_FILES:
        return
    scanned += 1
    try:
        st = path.stat()
        if not path.is_file() or st.st_size > MAX_FILE_SIZE:
            return
    except Exception:
        return

    low = path.name.lower()
    if low.endswith('.jar') and 'h2' in low:
        version = parse_ver_tuple(str(path))
        if version is not None:
            jar_hits.append((str(path), version))
        return

    if path.suffix.lower() not in CONFIG_EXTS and 'h2' not in low:
        return

    try:
        data = path.read_text(errors='ignore')
    except Exception:
        return

    if 'h2' in low and low.endswith('.jar'):
        version = parse_ver_tuple(data)
        if version is not None:
            jar_hits.append((str(path), version))

    for pat in indicator_patterns:
        for m in pat.finditer(data):
            line_start = data.rfind('\n', 0, m.start()) + 1
            line_end = data.find('\n', m.end())
            if line_end == -1:
                line_end = len(data)
            snippet = data[line_start:line_end].strip()
            exposure_hits.append((str(path), snippet[:220]))
            break


def walk_roots(roots):
    skip_dirs = {'.git', '.svn', 'node_modules', '__pycache__', 'proc', 'sys', 'dev', 'run', 'tmp', 'var/lib/docker/overlay2'}
    for root in roots:
        p = Path(root)
        if not p.exists():
            continue
        if p.is_file():
            scan_file(p)
            continue
        for base, dirs, files in os.walk(p, topdown=True):
            dirs[:] = [d for d in dirs if d not in skip_dirs]
            for name in files:
                if scanned >= MAX_FILES:
                    return
                scan_file(Path(base) / name)


def fmt_ver(v):
    return '.'.join(str(x) for x in v)


def main():
    if len(sys.argv) < 2:
        print('Usage: python3 verify_h2_cve_2021_42392.py <path> [<path> ...]')
        sys.exit(3)

    walk_roots(sys.argv[1:])

    vuln_jars = [(p, v) for p, v in jar_hits if is_vuln_version(v)]
    patched_jars = [(p, v) for p, v in jar_hits if not is_vuln_version(v) and ver_gte(v, FIXED)]

    if vuln_jars and exposure_hits:
        print('VULNERABLE')
        print('Reason: vulnerable H2 version(s) found with exposure indicator(s).')
        for p, v in vuln_jars[:10]:
            print(f'  H2: {p} -> {fmt_ver(v)}')
        for p, s in exposure_hits[:10]:
            print(f'  Exposure: {p} -> {s}')
        sys.exit(1)

    if vuln_jars and not exposure_hits:
        print('UNKNOWN')
        print('Reason: vulnerable H2 version(s) found, but no clear console-exposure indicator was discovered nearby.')
        for p, v in vuln_jars[:10]:
            print(f'  H2: {p} -> {fmt_ver(v)}')
        sys.exit(2)

    if patched_jars and not vuln_jars:
        print('PATCHED')
        print('Reason: only fixed H2 version(s) found (>= 2.0.206).')
        for p, v in patched_jars[:10]:
            print(f'  H2: {p} -> {fmt_ver(v)}')
        sys.exit(0)

    print('UNKNOWN')
    print('Reason: no H2 jars detected in supplied paths, or version/config could not be determined.')
    sys.exit(2)


if __name__ == '__main__':
    main()

Sources

1. Tenable plugin 158252
2. NVD CVE-2021-42392
3. GitHub Security Advisory GHSA-h376-j262-vhq6
4. JFrog technical analysis
5. Docker Scout advisory with EPSS
6. DIVD case and internet scanning timeline
7. H2 tutorial / console settings
8. Debian DSA-5076 backport advisory