关联漏洞
标题：
H2database代码问题漏洞
(CVE-2021-42392)
描述：H2database是一个用 Java 编写的可嵌入 Rdbms。 H2database 存在安全漏洞，该漏洞源于H2数据库的getConnection方法以驱动的类名和数据库的URL作为参数。攻击者可利用该漏洞传递JNDI驱动程序名称和指向LDAP或RMI服务器的URL，从而导致远程代码执行。
介绍
# CVE-2021-42392-Detect
# About
The script detects vulnerable H2 server for the give list of IPs, it can identify the H2 Console web pages and check for access restrictions.
### Usage
Create a file containing list of IPs and name the file IP.txt, place the 'IP.txt' and 'h2-detect.py' in a directory and execute the script.
Here "IP.txt" is the default filename that's hardcoded into script however the script can also take an random filename as input argument and
when if no filename is specified it searched for "IP.txt" file in the current directory and if it is not found it throws an file not found error.
So either specify a filename or simply place IP.txt file with the h2_detect.py scripts.
### Script Syntax
```
# Useing Default filename
`$ python h2_detect_v0.3.py IP.txt ` or `$ python h2_detect_v0.3.py`
# Specifying filename
`$ python3 h2_detect_v0.3.py <filename.txt>`
```
#### Error
### Requirments
pip install bs4
### Created by
Vivek Gopal
#### Security Analyst
#### Cybersecurityworks
文件快照
[4.0K] /data/pocs/e506ae47d936900883cf76ea189a6c025946345e
├── [ 29K] Detect_error1.png
├── [ 28K] Detect.png
├── [ 21K] Detect_usage1.png
├── [ 26K] Detect_usage2.png
├── [4.0K] h2_detect_v0.3.4.py
├── [8.6K] h2_detect_v0.3.7.py
└── [1.3K] README.md
0 directories, 7 files
备注
1. 建议优先通过来源进行访问。
2. 如果因为来源失效或无法访问，请发送邮箱到 f.jinxu#gmail.com 索取本地快照（把 # 换成 @）。
3. 神龙已为您对POC代码进行快照，为了长期维护，请考虑为本地POC付费，感谢您的支持。