Juggle <= 1.6.0 - Unauthenticated Exposed H2 Database Console
Juggle ships the H2 database web console enabled and reachable from non-localhost by default. No application-level authentication covers the /h2-console path, and the shipped default datasource credentials (sa/juggle) are known. An unauthenticated remote attacker can reach the console and, using the default credentials, achieve OS command execution on the host via the H2 CREATE ALIAS Runtime.exec() technique. References: https://github.com/somta/Juggle/issues/86 https://www.vulncheck.com/advisories/juggle-unauthenticated-rce-via-exposed-h2-console Remediation: Update to the latest version and change default credentials; restrict access to /h2-console.
url