Summary
Northstar exposes its H2 database console without authentication because the authentication interceptor covers only the /northstar/** path, while the console is available at /h2-console. A network-reachable attacker may use the exposed database interface and its default sa account with an empty password to execute operating-system commands before authentication.
Northstar exposes its H2 database console without authentication because the authentication interceptor covers only the /northstar/** path, while the console is available at /h2-console. A network-reachable attacker may use the exposed database interface and its default sa account with an empty password to execute operating-system commands before authentication.
Affected context
The issue affects Northstar deployments where the H2 Console is enabled and remains reachable through the application network interface. Risk is increased when the console is outside the authentication interceptor's protected path, the embedded H2 database retains default credentials, and the service process has meaningful operating-system or database privileges.
The issue affects Northstar deployments where the H2 Console is enabled and remains reachable through the application network interface. Risk is increased when the console is outside the authentication interceptor's protected path, the embedded H2 database retains default credentials, and the service process has meaningful operating-system or database privileges.
Exploit preconditions
- Attack surface: Network-reachable H2 Console endpoint
- Required access: No application authentication; network connectivity to the exposed console is sufficient
- Trigger point: H2 database operations submitted through
/h2-console - Why exploitation is possible: The endpoint is not covered by the authentication interceptor, the database accepts default
sacredentials with an empty password, and H2 functionality can invoke system-level command execution features
- Attack surface: Network-reachable H2 Console endpoint
- Required access: No application authentication; network connectivity to the exposed console is sufficient
- Trigger point: H2 database operations submitted through
/h2-console - Why exploitation is possible: The endpoint is not covered by the authentication interceptor, the database accepts default
sacredentials with an empty password, and H2 functionality can invoke system-level command execution features
Why this happens
The vulnerability results from incomplete authorization coverage combined with insecure database defaults and exposed administrative functionality. Northstar protects only the /northstar/** route space, leaving /h2-console accessible without authentication; the embedded H2 database also uses a blank default password. H2 features that support Java alias creation can then be abused to achieve command execution, mapping to CWE-94: Improper Control of Generation of Code.
The vulnerability results from incomplete authorization coverage combined with insecure database defaults and exposed administrative functionality. Northstar protects only the /northstar/** route space, leaving /h2-console accessible without authentication; the embedded H2 database also uses a blank default password. H2 features that support Java alias creation can then be abused to achieve command execution, mapping to CWE-94: Improper Control of Generation of Code.
Potential impact
- An attacker may execute arbitrary operating-system commands as the Northstar service account.
- A compromise could allow theft or manipulation of trading and database data.
- An attacker could establish persistence or use the host for lateral movement.
- The service may be disrupted, and trading operations could be affected.
- Sensitive credentials or environment data could be exposed.
- An attacker may execute arbitrary operating-system commands as the Northstar service account.
- A compromise could allow theft or manipulation of trading and database data.
- An attacker could establish persistence or use the host for lateral movement.
- The service may be disrupted, and trading operations could be affected.
- Sensitive credentials or environment data could be exposed.
General mitigation guidance
Mitigation generally focuses on removing unnecessary administrative attack surfaces and enforcing authentication at every exposed route.
Common defensive patterns include:
- Disable the H2 Console in production and other environments where it is not required.
- Place database consoles behind strong, centralized authentication and authorization controls.
- Ensure security middleware covers console, management, and diagnostic paths explicitly.
- Replace default database credentials with unique, managed secrets and prohibit empty passwords.
- Restrict console access through network segmentation, allowlists, private interfaces, or administrative VPNs.
- Run the service with least-privilege operating-system and database permissions.
- Avoid exposing embedded development databases as operational production interfaces.
Mitigation generally focuses on removing unnecessary administrative attack surfaces and enforcing authentication at every exposed route.
Common defensive patterns include:
- Disable the H2 Console in production and other environments where it is not required.
- Place database consoles behind strong, centralized authentication and authorization controls.
- Ensure security middleware covers console, management, and diagnostic paths explicitly.
- Replace default database credentials with unique, managed secrets and prohibit empty passwords.
- Restrict console access through network segmentation, allowlists, private interfaces, or administrative VPNs.
- Run the service with least-privilege operating-system and database permissions.
- Avoid exposing embedded development databases as operational production interfaces.
How teams detect issues like this
Organizations can identify similar weaknesses through:
- Static and configuration analysis for enabled H2 or other embedded database consoles.
- Code review checks comparing authentication route patterns with all management and diagnostic endpoints.
- Testing unauthenticated access to console paths in staging and production-like environments.
- Policy enforcement that blocks empty or default database credentials.
- Network monitoring for requests to
/h2-consoleand other administrative endpoints. - Automated application security testing that verifies authentication coverage and authorization boundaries.
Organizations can identify similar weaknesses through:
- Static and configuration analysis for enabled H2 or other embedded database consoles.
- Code review checks comparing authentication route patterns with all management and diagnostic endpoints.
- Testing unauthenticated access to console paths in staging and production-like environments.
- Policy enforcement that blocks empty or default database credentials.
- Network monitoring for requests to
/h2-consoleand other administrative endpoints. - Automated application security testing that verifies authentication coverage and authorization boundaries.
Sources
| Source | Link |
|---|---|
| github. | github.com/ |
