CVE-2025-5662: H2O-3 REST API RCE Vulnerability

CVE-2025-5662 Overview

A critical deserialization vulnerability exists in the H2O-3 REST API that allows remote code execution (RCE) through improper validation of JDBC connection parameters. The vulnerability is present in the POST /99/ImportSQLTable endpoint and affects all versions of H2O-3 up to 3.46.0.7. When exploiting this flaw, attackers can leverage the Key-Value format in JDBC connection strings to execute arbitrary code on vulnerable systems without authentication.

Critical Impact

This vulnerability enables unauthenticated remote code execution, allowing attackers to completely compromise H2O-3 installations and potentially pivot to other systems within the network infrastructure.

Affected Products

• H2O-3 versions up to 3.46.0.7
• Systems using MySQL JDBC Driver version 8.0.19
• Environments running JDK version 8u112

Discovery Timeline

• 2025-09-02 - CVE-2025-5662 published to NVD
• 2025-09-02 - Last updated in NVD database

Technical Details for CVE-2025-5662

Vulnerability Analysis

This deserialization vulnerability (CWE-502) stems from the H2O-3 REST API's failure to properly validate JDBC connection parameters when users submit requests to the ImportSQLTable endpoint. The vulnerability allows attackers to craft malicious JDBC connection strings that trigger unsafe deserialization of untrusted data, ultimately leading to arbitrary code execution on the target system.

The attack can be executed remotely over the network without requiring any authentication or user interaction. Successful exploitation results in complete system compromise, with attackers gaining the ability to execute arbitrary commands with the privileges of the H2O-3 process, read or modify sensitive data, and potentially use the compromised system as a foothold for lateral movement within the network.

Root Cause

The root cause lies in improper input validation within the JDBC connection parameter handling logic. When processing SQL import requests, the application fails to adequately sanitize or validate user-supplied connection strings in Key-Value format. This allows attackers to inject malicious serialized objects through the JDBC driver's autoDeserialize feature, which the MySQL JDBC Driver 8.0.19 processes without proper security controls.

Attack Vector

The attack is carried out by sending a specially crafted POST request to the /99/ImportSQLTable endpoint with malicious JDBC connection parameters. The attacker constructs a connection string that exploits the MySQL JDBC driver's deserialization capabilities.

An attacker would typically send a POST request to the vulnerable endpoint containing a JDBC URL with embedded serialized payload data. The connection string includes parameters that trigger the MySQL JDBC driver to deserialize attacker-controlled data, leading to code execution. Technical details of the exploitation methodology can be found in the Huntr bounty submission.

Detection Methods for CVE-2025-5662

Indicators of Compromise

• Unexpected POST requests to the /99/ImportSQLTable endpoint from external or unauthorized sources
• JDBC connection strings containing suspicious parameters such as autoDeserialize=true or encoded serialized objects
• Unusual process spawning from the H2O-3 Java process
• Network connections to unexpected destinations following SQL import requests

Detection Strategies

• Monitor HTTP traffic for POST requests to /99/ImportSQLTable with anomalous JDBC URL patterns
• Implement application-layer inspection to detect serialized Java objects in JDBC connection strings
• Deploy endpoint detection and response (EDR) solutions to identify suspicious process behavior from H2O-3 services
• Enable detailed logging on H2O-3 REST API endpoints and review for unusual activity patterns

Monitoring Recommendations

• Configure network intrusion detection systems (NIDS) to alert on suspicious patterns in JDBC connection strings
• Establish baseline network behavior for H2O-3 instances and alert on deviations
• Monitor system calls and file system activity from the H2O-3 process for signs of exploitation
• Implement real-time log analysis for REST API access patterns

How to Mitigate CVE-2025-5662

Immediate Actions Required

• Upgrade H2O-3 to version 3.46.0.8 or later immediately
• Restrict network access to the H2O-3 REST API to trusted sources only
• Implement web application firewall (WAF) rules to filter malicious JDBC connection parameters
• Review access logs for any signs of prior exploitation attempts

Patch Information

The vulnerability has been addressed in H2O-3 version 3.46.0.8. The fix implements proper validation and sanitization of JDBC connection parameters to prevent deserialization attacks. Organizations should apply this update as soon as possible. The specific code changes can be reviewed in the GitHub commit for H2O-3.

Workarounds

• Place H2O-3 instances behind a reverse proxy with strict input validation
• Disable or restrict access to the ImportSQLTable functionality if not required
• Implement network segmentation to isolate H2O-3 instances from untrusted networks
• Use firewall rules to limit which hosts can connect to the H2O-3 REST API

# Example: Restrict access to H2O-3 REST API using iptables
iptables -A INPUT -p tcp --dport 54321 -s 10.0.0.0/8 -j ACCEPT
iptables -A INPUT -p tcp --dport 54321 -j DROP