CVE-2024-45758 H2O.ai H2O vulnerable to deserialization attacks via a JDBC Connection URL
Attackers can execute arbitrary code and read files by injecting malicious JDBC URLs into the ImportSQLTable endpoint of the H2O.ai library.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2024-45758?
CVE-2024-45758 is a critical unsafe deserialization vulnerability in n/a, published on 6 Sep 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
H2O.ai H2O through 3.46.0.4 allows attackers to arbitrarily set the JDBC URL, leading to deserialization attacks, file reads, and command execution. Exploitation can occur when an attacker has access to post to the ImportSQLTable URI with a JSON document containing a connection_url property with any typical JDBC Connection URL attack payload such as one that uses queryInterceptors.
Weakness: CWE-502
Which versions are affected by CVE-2024-45758?
5 open source packages ship an affected version, including h2o and ai.h2o:h2o-core. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
h2o PyPI | All versions to 3.46.0.7 | None |
h2o PyPI | All versions to 3.46.0.7 | None |
h2o PyPI | All versions to 3.46.0.7 | None |
ai.h2o:h2o-core Maven | All versions to 3.46.0.7 | None |
ai.h2o:h2o-core Maven | All versions to 3.46.0.7 | None |
Products include H2o H2o.
How do I fix CVE-2024-45758?
No fix has been published for CVE-2024-45758 yet. Limit exposure of the affected software until one is available.
Upgrade, and only deserialise data from trusted sources or with an allow-list of types. More about Unsafe deserialization.
Is CVE-2024-45758 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-45758 exists.
Other vulnerabilities in n/a
Sources
Also known as GHSA-hrmc-jmp7-mpm2, PYSEC-2026-352.