Other nomination

Chaining Exposed Actuators and H2 Database Aliases in Spring Boot 2

An exposed Spring Boot 2 actuator env endpoint lets an attacker set the HikariCP connection test query, which the pool runs as SQL on the next database connection. Against an H2 database that query can CREATE ALIAS a Java function and call it, giving remote code execution, with CONCAT and HEXTORAW string tricks to evade WAF filters.

Record

Date

12 January 2020

In the archive

• Nominated for the 2020 Top 10 Web Hacking Techniques

Related sources

• Original Spring Boot actuator research
• Demonstration application
• Foundational H2 alias technique

Tags

• rce
• command-injection
• injection
• waf-bypass
• attack-chain
• spring
• java
• database
• case-study
• owasp-a03-2021
• owasp-a05-2021

This page is the archive's own catalogue record. The research is the work of its author, first published at the original source. Preserved copies are kept so the citation survives its host.