CVE-2022-45868: 
H2 Database vulnerability analysis and mitigation

The H2 Database Engine before version 2.2.220 contains a security vulnerability where the web-based admin console can be started via the CLI with the argument -webAdminPassword, allowing users to specify the password in cleartext. This vulnerability was discovered in 2022 and assigned CVE-2022-45868. The issue affects H2 Database versions from 1.4.198 to versions before 2.2.220 (GitHub Advisory, Sonatype Report).

The vulnerability stems from the ability to pass the web admin console password as a command-line argument using -webAdminPassword in plaintext. When the H2 Database is started with this parameter, the password becomes visible to any local user who can list running processes. The issue has a CVSS v3.1 base score of 7.8 (HIGH) with vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. The vulnerability is classified under CWE-312 (Cleartext Storage of Sensitive Information) (NVD).

If exploited, this vulnerability allows local users or attackers with local access to discover the password for the H2 web admin console by examining process listings. According to H2 developers, users with admin privileges can perform any action on the system that the owner of the H2 process would be able to execute. The command-line argument also overwrites any password specified in the configuration file, potentially bypassing more secure password storage methods (Sonatype Report).

The issue was fixed in H2 Database version 2.2.220, which disallows plain webAdminPassword values and forces the usage of hashes. For systems that cannot be immediately upgraded, the recommended approach is to specify the admin password in the .h2.server.properties configuration file rather than using command-line arguments. The configuration file automatically stores passwords in a secure salted hash format when saved through the H2 Console settings (GitHub PR).

Initially, the H2 Database maintainers disputed this as a vulnerability, stating 'This is not a vulnerability of H2 Console... Passwords should never be passed on the command line and every qualified DBA or system administrator is expected to know that.' However, they later acknowledged the security implications and implemented a fix to prevent plaintext password usage (GitHub Issue).