CVE-2022-41853

Deeper analysis

Those using java.sql.Statement or java.sql.PreparedStatement in hsqldb (HyperSQL DataBase) to process untrusted input may be vulnerable to remote code execution. By default the database allows invocation of any static method on classes in the classpath, enabling arbitrary code execution when attacker-controlled SQL is executed. The flaw is tracked as CVE-2022-41853 with a CVSS 3.1 score of 8.0 and is also associated with CWE-470.

An attacker with the ability to supply input processed through these JDBC interfaces can achieve full remote code execution on the database server. Exploitation requires the attacker to craft SQL that invokes dangerous static methods; the attack is rated as needing high complexity, low privileges, and some user interaction, yet results in complete compromise of confidentiality, integrity, and availability in a scoped context.

The vendor states that the issue is resolved in version 2.7.1, which restricts callable classes to java.lang.Math by default; earlier versions can be hardened by setting the system property hsqldb.method_class_names to an explicit allow-list. Debian has issued updates via DSA-5313 and corresponding LTS advisories that apply the same restrictions or package upgrades.

EPSS for the CVE rose from a low baseline to a peak of 0.7449 (currently 0.7014), indicating measurable post-disclosure exploitation interest that warrants renewed attention from defenders.