Description
H2database是一个用 Java 编写的可嵌入 Rdbms。 H2database 存在安全漏洞，该漏洞源于H2数据库的getConnection方法以驱动的类名和数据库的URL作为参数。攻击者可利用该漏洞传递JNDI驱动程序名称和指向LDAP或RMI服务器的URL，从而导致远程代码执行。
H2 Database 远程代码执行漏洞
PoC
None yet. Search at https://trap.biu.life/?ref=rssReferences
https://www.leavesongs.com/PENETRATION/talk-about-h2database-rce.html
https://github.com/Threekiii/Vulnerability-Wiki/blob/master/docs-base/docs/database/H2-Database-Web-Console-%E8%AE%A4%E8%AF%81%E8%BF%9C%E7%A8%8B%E4%BB%A3%E7%A0%81%E6%89%A7%E8%A1%8C%E6%BC%8F%E6%B4%9E-CVE-2018-10054.md
https://www.cnblogs.com/cwkiller/p/18957721
https://www.h3c.com/cn/d_202207/1644468_30003_0.htm
https://zgao.top/spring-boot-actuator-h2-%E8%BF%9C%E7%A8%8B%E4%BB%A3%E7%A0%81%E6%89%A7%E8%A1%8C%E6%BC%8F%E6%B4%9E%E5%A4%8D%E7%8E%B0-poc%E4%BC%98%E5%8C%96%E8%A7%A3%E5%86%B3%E5%91%BD%E4%BB%A4%E6%89%A7%E8%A1%8C/
https://rivers.chaitin.cn/blog/cq9k4ch0lnechd245jbg
https://nic.jiangnan.edu.cn/info/1102/3519.htm
https://www.secrss.com/articles/38106
https://www.sentinelone.com/vulnerability-database/cve-2021-42392/
https://bbs.huaweicloud.com/forum/thread-177344-1-1.html
https://blog.csdn.net/jam55/article/details/153305383
https://www.govcert.gov.hk/tc/alerts_detail.php?id=714
https://nosec.org/m/share/5097.html
https://juejin.cn/post/7055214616615321608
https://www.exploit-db.com/exploits/45506
https://nvd.nist.gov/vuln/detail/cve-2021-42392
https://jfrog.com/blog/the-jndi-strikes-back-unauthenticated-rce-in-h2-database-console/