CVE-2024-45758: H2O.ai H2O RCE Vulnerability

CVE-2024-45758 Overview

CVE-2024-45758 is a critical insecure deserialization vulnerability affecting H2O.ai H2O through version 3.46.0.4. The vulnerability allows attackers to arbitrarily set the JDBC URL through the ImportSQLTable endpoint, leading to deserialization attacks, arbitrary file reads, and remote command execution. Exploitation occurs when an attacker posts a malicious JSON document containing a crafted connection_url property with JDBC connection URL attack payloads, such as those utilizing queryInterceptors.

Critical Impact

Unauthenticated attackers can achieve remote code execution, read sensitive files, and execute arbitrary commands on systems running vulnerable H2O instances by exploiting unrestricted JDBC connection handling.

Affected Products

• H2O.ai H2O versions up to and including 3.46.0.4
• Systems exposing the ImportSQLTable API endpoint
• Deployments without network-level access controls to H2O endpoints

Discovery Timeline

• 2024-09-06 - CVE-2024-45758 published to NVD
• 2025-09-29 - Last updated in NVD database

Technical Details for CVE-2024-45758

Vulnerability Analysis

This vulnerability stems from improper handling of user-controlled JDBC connection URLs in the H2O machine learning platform. The ImportSQLTable API endpoint accepts JSON payloads containing a connection_url parameter without adequate validation or sanitization. This design flaw allows attackers to inject malicious JDBC URLs that can trigger Java deserialization attacks, read arbitrary files from the server filesystem, or execute system commands.

The attack surface is significant because H2O is commonly deployed in data science and machine learning environments where it may have access to sensitive datasets, model artifacts, and infrastructure credentials. The unauthenticated nature of this vulnerability means that any network-accessible H2O instance is potentially exploitable without prior compromise.

Root Cause

The root cause is CWE-502 (Deserialization of Untrusted Data). The H2O application fails to properly validate or restrict JDBC connection URLs before establishing database connections. This allows attackers to leverage known JDBC driver exploitation techniques, including MySQL queryInterceptors that can trigger arbitrary code execution through deserialization gadgets present in the application classpath.

Attack Vector

The attack is executed remotely over the network with no authentication required. An attacker sends a specially crafted HTTP POST request to the /ImportSQLTable URI containing a JSON document with a malicious connection_url property. The JDBC URL payload can include parameters that exploit MySQL Connector/J features like queryInterceptors or autoDeserialize to trigger deserialization of malicious objects, potentially leading to full system compromise.

The exploitation flow involves: (1) crafting a malicious JDBC connection URL with exploitation parameters, (2) sending a POST request to the vulnerable endpoint, (3) the server processes the connection string and triggers the embedded payload, and (4) achieving code execution or file access on the target system. Technical details and proof-of-concept information are available through the Notion Analysis on Remote Code Execution and the GitHub Gist PoC Script.

Detection Methods for CVE-2024-45758

Indicators of Compromise

• HTTP POST requests to /ImportSQLTable endpoint containing suspicious connection_url parameters
• JDBC connection strings with queryInterceptors, autoDeserialize=true, or allowLoadLocalInfile parameters
• Unexpected outbound connections from H2O processes to external MySQL or database servers
• Java deserialization-related errors or stack traces in H2O application logs
• Unexpected child processes spawned by the H2O Java process

Detection Strategies

• Implement web application firewall (WAF) rules to inspect and block POST requests containing malicious JDBC URL patterns
• Monitor network traffic for unusual database connection attempts originating from H2O server instances
• Deploy endpoint detection and response (EDR) solutions to detect suspicious process execution chains originating from Java processes
• Implement log analysis rules to detect access patterns targeting the ImportSQLTable endpoint

Monitoring Recommendations

• Enable detailed logging for all API endpoints in H2O and forward logs to a SIEM for analysis
• Monitor for POST requests to H2O API endpoints from unexpected source IP addresses
• Set up alerts for Java processes making connections to external database servers or spawning shell processes
• Review H2O access logs for repeated attempts to access SQL import functionality

How to Mitigate CVE-2024-45758

Immediate Actions Required

• Restrict network access to H2O instances using firewall rules and network segmentation
• Implement authentication mechanisms in front of H2O deployments if not already present
• Disable or remove the ImportSQLTable functionality if not required for operations
• Monitor for exploitation attempts while planning upgrade or remediation activities

Patch Information

Organizations should monitor H2O.ai's official channels for security updates addressing CVE-2024-45758. As of the CVE publication, affected versions include H2O through 3.46.0.4. Contact H2O.ai support for guidance on patching or upgrading to a version that addresses this vulnerability. In the interim, implement the recommended workarounds to reduce risk exposure.

Workarounds

• Deploy H2O instances behind a reverse proxy with strict input validation to filter malicious JDBC URLs
• Implement network-level access controls to limit which systems can communicate with H2O API endpoints
• Use application-level allowlisting for permitted JDBC connection URLs if the functionality is required
• Consider running H2O in a containerized environment with restricted network egress capabilities

# Example: Restricting access to H2O port using iptables
# Only allow connections from trusted internal network
iptables -A INPUT -p tcp --dport 54321 -s 10.0.0.0/8 -j ACCEPT
iptables -A INPUT -p tcp --dport 54321 -j DROP