CVE-2024-8862: h2oai h2o-3 JDBC Connection 1 getConnectionSafe deserialization
A vulnerability, which was classified as critical, has been found in h2oai h2o-3 3.46.0.4. This issue affects the function getConnectionSafe of the file /dtale/chart-data/1 of the component JDBC Connection Handler. The manipulation of the argument query leads to deserialization. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Other sources
D-Tale is the combination of a Flask back-end and a React front-end to bring you an easy way to view & analyze Pandas data structures. In dtale\views.py, under the route @dtale.route("/chart-data/<dataid>"), the query parameters from the request are directly passed into runquery for execution. And the runquery function calls proceed without performing any processing or sanitization of the query parameter. As a result, the query is directly used in the df.query method for data retrieval. Tthe engine used is python, which allows executing the query expression ans leading to a command execution vulnerability.
— GitHub
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-8862?
CVE-2024-8862 is classified as a critical vulnerability.
What software versions are affected by CVE-2024-8862?
CVE-2024-8862 affects H2O.ai H2O version 3.46.0.4 and earlier versions of the dtale package below 3.14.1.
How do I fix CVE-2024-8862?
To fix CVE-2024-8862, upgrade to H2O.ai H2O version 3.46.0.4 or later and update the dtale package to version 3.14.1 or above.
What type of attack does CVE-2024-8862 enable?
CVE-2024-8862 enables deserialization attacks due to improper handling of JDBC connection queries.
Which component is vulnerable in CVE-2024-8862?
The vulnerability CVE-2024-8862 affects the JDBC Connection Handler in the getConnectionSafe function.