AlvaroNeovia commented on issue #2542:
URL:
https://github.com/apache/shardingsphere-elasticjob/issues/2542#issuecomment-5787134811
**Follow-up: the H2 `INIT` channel reaches code execution under the same
whitelist configuration (verified in lab)**
The title mentions "H2 INIT -> RCE" — adding the verification detail here,
since it raises the impact of the incomplete fix beyond server-side TCP:
- **Path**: `POST /api/data-source/connectTest` → `driver=org.h2.Driver`
(the whitelist example) → `url=jdbc:h2:mem:x;INIT=CREATE ALIAS IF NOT EXISTS E
AS '<java source>'\;CALL E()`
- **Result**: `{"success":true}` returned; the alias executes with the OS
privileges of the UI process (in our disposable lab: `uid=0`, proof file
captured — happy to share).
- **Reproduction gotcha**: a bare `;` inside the `INIT` value truncates the
H2 URL parse (`URL format error ... 90046-196`); escaping as `\;` makes the
channel work. This is the failure mode most reviewers hit first.
- **Why the driver whitelist is not a fix for this**: the whitelist
constrains *which driver class* may load, not the *URL semantics*. Any
whitelisted driver exposing URL-scriptable behaviour (H2 `INIT` incl. `CREATE
ALIAS` / `RUNSCRIPT FROM` / JNDI) yields code execution; drivers without such
features still yield raw TCP/data exfiltration (as reported).
Reply here if a full PoC package (request body, expected responses,
proof-of-exec output) would help.
---
*(Same disposable-lab conditions as the original report; no third-party
systems touched.)*
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
