{"id":"CVE-2024-45758","kind":"vulnerability","aliases":["CVE-2024-45758","GHSA-hrmc-jmp7-mpm2"],"related":[],"title":"H2O.ai H2O vulnerable to deserialization attacks via a JDBC Connection URL","description":"H2O.ai H2O through 3.46.0.4 allows attackers to arbitrarily set the JDBC URL, leading to deserialization attacks, file reads, and command execution. Exploitation can occur when an attacker has access to post to the ImportSQLTable URI with a JSON document containing a connection_url property with any typical JDBC Connection URL attack payload such as one that uses queryInterceptors.","summary":"H2O.ai H2O lets an attacker set an arbitrary JDBC connection URL through the ImportSQLTable endpoint. A crafted URL such as one using queryInterceptors can trigger deserialization, file reads and command execution on the server.","severity":"critical","cvss":9.1,"epss":0.00906,"exploited":false,"exploited_at":null,"products":[{"name":"ai.h2o:h2o-core","fixed":[],"affected":"<= 3.46.0.7","ecosystem":"maven"},{"name":"h2o","fixed":[],"affected":"<= 3.46.0.7","ecosystem":"pypi"},{"name":"h2o","fixed":[],"affected":"<= 3.46.0.4","ecosystem":"vendor"}],"ecosystems":["maven","pypi","vendor"],"tags":["ai-tooling","cwe-502","data-science","h2o","java","python","self-hosted"],"not_affected_if":["auth-required","no-untrusted-access"],"how_to_check":"- Check the installed version with `pip show h2o` or inspect the `ai.h2o:h2o-core` Maven dependency; versions through `3.46.0.4` are described as affected, and the advisory lists `3.46.0.7` as affected through the range.\n- Confirm whether the H2O server exposes the ImportSQLTable REST endpoint to untrusted networks.","fix":"- Upgrade `h2o` (PyPI) and `ai.h2o:h2o-core` (Maven) to a version newer than `3.46.0.7`; the fixed version is unknown from the sources.\n- Restrict network access to the H2O API port until the upgrade is applied.","status":"open","published_at":"2024-09-06T16:15:03+00:00","first_seen_at":"2026-10-27T17:27:29+00:00","triaged_at":"2026-10-27T17:27:57+00:00","updated_at":"2026-10-27T17:32:47+00:00","category":"ai-tooling","confidence":0.6,"triage":{"at":"2026-10-27T17:27:57Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade `h2o` (PyPI) and `ai.h2o:h2o-core` (Maven) to a version newer than `3.46.0.7`; the fixed version is unknown from the sources.\n- Restrict network access to the H2O API port until the upgrade is applied.","reach":"network","title":"H2O.ai H2O: JDBC URL injection lets attackers run commands on server","impact":"high","summary":"H2O.ai H2O lets an attacker set an arbitrary JDBC connection URL through the ImportSQLTable endpoint. A crafted URL such as one using queryInterceptors can trigger deserialization, file reads and command execution on the server.","category":"ai-tooling","nicknames":[],"who_cares":["h2o","python","java","self-hosted","data-science"],"confidence":0.6,"needs_auth":"unknown","worst_case":"Attacker runs commands on the H2O server and reads files.","analyst_note":"Find the fixed version and the default auth posture of the H2O REST API at https://github.com/advisories/GHSA-hrmc-jmp7-mpm2.","how_to_check":"- Check the installed version with `pip show h2o` or inspect the `ai.h2o:h2o-core` Maven dependency; versions through `3.46.0.4` are described as affected, and the advisory lists `3.46.0.7` as affected through the range.\n- Confirm whether the H2O server exposes the ImportSQLTable REST endpoint to untrusted networks.","needs_analyst":true,"not_affected_if":["auth-required","no-untrusted-access"],"who_is_affected":"Teams running H2O-3 servers that accept requests to the ImportSQLTable endpoint, which is exposed on the H2O REST API. Exposure depends on whether untrusted users can reach that endpoint; servers reachable only from trusted internal networks with no untrusted users are lower risk. unknown whether a default configuration restricts this endpoint.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000698,"input_tokens":3439,"output_tokens":708,"severity_before":"critical"},"analyst_status":null,"analyst_note":null,"search":"'-2024':13A,21A '-45758':14A,22A '-502':33B '3.46.0.4':80C 'access':105C 'ai':30B 'ai-tool':29B 'ai.h2o':23A 'allow':81C 'arbitrari':50B 'arbitrarili':84C 'attack':6A,47B,82C,92C,103C,127C 'command':72B,96C 'connect':10A,52B,118C,125C 'contain':116C 'core':26A 'craft':59B 'cve':12A,20A 'cwe':32B 'data':35B 'data-sci':34B 'deseri':5A,68B,91C 'document':115C 'endpoint':57B 'execut':73B,97C 'exploit':98C 'file':69B,93C 'ghsa':16A 'ghsa-hrmc-jmp7-mpm2':15A 'h2o':2A,25A,27A,28A,37B,44B,78C 'h2o-core':24A 'h2o.ai':1A,43B,77C 'host':42B 'hrmc':17A 'importsqlt':56B,110C 'java':38B 'jdbc':9A,51B,87C,124C 'jmp7':18A 'json':114C 'lead':89C 'let':45B 'mpm2':19A 'occur':100C 'one':63B,131C 'payload':128C 'post':107C 'properti':120C 'python':39B 'queryinterceptor':65B,134C 'read':70B,94C 'scienc':36B 'self':41B 'self-host':40B 'server':76B 'set':48B,85C 'tool':31B 'trigger':67B 'typic':123C 'uri':111C 'url':11A,53B,60B,88C,119C,126C 'use':64B,133C 'via':7A 'vulner':3A","nicknames":[],"mitigations":[],"who_affected":"Teams running H2O-3 servers that accept requests to the ImportSQLTable endpoint, which is exposed on the H2O REST API. Exposure depends on whether untrusted users can reach that endpoint; servers reachable only from trusted internal networks with no untrusted users are lower risk. unknown whether a default configuration restricts this endpoint.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2024-09-06T16:15:03+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","cvss_by":"GitHub","poc_count":0,"sources":[{"source":"ghsa","external_id":"GHSA-hrmc-jmp7-mpm2","url":"https://github.com/advisories/GHSA-hrmc-jmp7-mpm2","severity":"critical","published_at":"2024-09-06T18:31:31+00:00","modified_at":"2026-10-27T17:27:19+00:00","first_seen_at":"2026-10-27T17:27:29+00:00","fetched_at":"2026-10-27T17:32:35+00:00","note":null},{"source":"nvd","external_id":"CVE-2024-45758","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-45758","severity":null,"published_at":"2024-09-06T16:15:03+00:00","modified_at":"2026-06-17T07:54:45+00:00","first_seen_at":"2026-10-27T17:32:47+00:00","fetched_at":"2026-10-27T17:32:47+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}