CVE-2021-23463: H2 Database XXE Injection Vulnerability

CVE-2021-23463 Overview

CVE-2021-23463 is an XML External Entity (XXE) Injection vulnerability [CWE-611] affecting the com.h2database:h2 package from version 1.4.198 up to but not including 2.0.202. The flaw resides in the org.h2.jdbc.JdbcSQLXML class object when it receives parsed string data from the org.h2.jdbc.JdbcResultSet.getSQLXML() method. Invoking getSource() with DOMSource.class as the parameter triggers the vulnerability. Attackers can exploit the issue to read arbitrary files, perform Server-Side Request Forgery (SSRF), or cause denial of service against applications that process untrusted SQLXML data through H2.

Critical Impact

Remote attackers can exfiltrate sensitive files and disrupt service availability on Java applications using vulnerable H2 versions to handle SQLXML content.

Affected Products

• H2 Database Engine com.h2database:h2 versions 1.4.198 through 2.0.201
• Oracle products bundling H2 (see Oracle Critical Patch Update April 2022)
• NetApp products bundling H2 (see NetApp Security Advisory NTAP-20230818-0010)

Discovery Timeline

• 2021-12-10 - CVE-2021-23463 published to the National Vulnerability Database (NVD)
• 2024-11-21 - Last updated in NVD database

Technical Details for CVE-2021-23463

Vulnerability Analysis

The vulnerability stems from unsafe XML parsing in the H2 JDBC driver. When an application calls JdbcResultSet.getSQLXML(), H2 returns a JdbcSQLXML object holding the raw XML string from the database. Calling JdbcSQLXML.getSource(DOMSource.class) on that object triggers DOM parsing of the XML content without disabling external entity resolution.

Because the underlying XML parser accepts DOCTYPE declarations and external entity references, an attacker who controls the XML payload can declare entities that resolve to local files or remote URLs. The parser dereferences those entities during processing, exposing file contents or initiating outbound requests from the database server's JVM.

Exploitation requires that an application reads attacker-influenced XML data from an H2 column and converts it via getSource(DOMSource.class). The network attack vector applies wherever attacker-controlled XML can reach this code path, including web applications that store user input in H2 SQLXML columns.

Root Cause

The JdbcSQLXML implementation constructs a DocumentBuilder without calling setFeature("http://apache.org/xml/features/disallow-doctype-decl", true) or disabling external general and parameter entities. This configuration leaves the parser in its default, insecure state, satisfying the conditions for [CWE-611] Improper Restriction of XML External Entity Reference.

Attack Vector

An attacker supplies an XML payload containing an external entity such as <!ENTITY xxe SYSTEM "file:///etc/passwd"> and arranges for the target application to retrieve that payload through JdbcResultSet.getSQLXML() and process it with getSource(DOMSource.class). The resolved entity value is returned in the parsed DOM, allowing the attacker to read local files, probe internal network services, or trigger resource exhaustion. The fix in version 2.0.202 disables DTD processing and external entities in the SQLXML parser. See the H2 GitHub Pull Request #3199 and commit d83285fd for the remediation details.

Detection Methods for CVE-2021-23463

Indicators of Compromise

• Outbound DNS or HTTP requests originating from the JVM running H2 to unexpected external hosts, indicating XXE entity resolution.
• XML payloads in database columns or application logs containing <!DOCTYPE declarations or SYSTEM entity references.
• Unexpected file reads of sensitive paths such as /etc/passwd, C:\Windows\win.ini, or application configuration files by the H2 process.

Detection Strategies

• Inventory Java dependencies for com.h2database:h2 versions between 1.4.198 and 2.0.201 using Software Composition Analysis (SCA) tools.
• Review application source code for calls to JdbcResultSet.getSQLXML() followed by getSource(DOMSource.class) on untrusted data.
• Inspect network egress from database hosts for anomalous outbound connections triggered by XML parsing.

Monitoring Recommendations

• Alert on JVM processes performing file system reads outside their normal working directory.
• Monitor for DNS lookups to attacker-controlled domains originating from application servers running H2.
• Capture and review SQL queries that insert or retrieve XML content into SQLXML columns for malicious DOCTYPE markup.

How to Mitigate CVE-2021-23463

Immediate Actions Required

• Upgrade com.h2database:h2 to version 2.0.202 or later across all build artifacts and runtime environments.
• Audit application code paths that invoke JdbcResultSet.getSQLXML().getSource(DOMSource.class) on data originating from untrusted sources.
• Apply vendor patches from Oracle Critical Patch Update April 2022 and the NetApp NTAP-20230818-0010 advisory for bundled products.

Patch Information

The maintainers fixed the issue in H2 version 2.0.202 by hardening the XML parser configuration in JdbcSQLXML. The patch is documented in H2 GitHub Issue #3195, Pull Request #3199, and the Snyk Vulnerability Report. Downstream vendors should consult the Oracle Security Alert and NetApp Security Advisory for product-specific fixes.

Workarounds

• Avoid calling getSource(DOMSource.class) on SQLXML data from H2; use getString() and parse the XML with a hardened parser that disables DTDs and external entities.
• Configure a custom DocumentBuilderFactory with setFeature("http://apache.org/xml/features/disallow-doctype-decl", true) and disable external general and parameter entities before processing untrusted XML.
• Restrict outbound network access from database and application hosts to limit SSRF and data exfiltration if exploitation occurs.

# Update Maven dependency to the patched version
# In pom.xml:
# <dependency>
#   <groupId>com.h2database</groupId>
#   <artifactId>h2</artifactId>
#   <version>2.0.202</version>
# </dependency>

mvn versions:use-dep-version -Dincludes=com.h2database:h2 -DdepVersion=2.0.202 -DforceVersion=true
mvn clean verify