An unauthenticated remote code execution vulnerability in somta Juggle allows attackers to gain full system control via the exposed H2 database console.

This vulnerability involves missing authentication for critical functions (CWE-306) and insecure default initialization (CWE-1188). Attackers can access the H2 database web console without authentication and use the runtime execution feature to run arbitrary commands as the root user.

The CVSS 4.0 score of 9.8 highlights the critical risk of total system takeover. Successful exploitation grants attackers root-level access, enabling full data exfiltration, permanent system backdoors, and complete control over the host environment, which is especially dangerous in containerized deployments like Docker.

Immediate Action: Restrict network access to the H2 console immediately and change all default credentials to strong, unique passwords.

Proactive Monitoring: Monitor for unexpected process execution or abnormal network connections originating from the Juggle application container.

Compensating Controls: Deploy a Web Application Firewall (WAF) to block access to the /h2-console endpoint and verify that the application is running with the principle of least privilege.

Public Exploit Available: Unknown

This vulnerability is highly critical due to the combination of unauthenticated access and root-level command execution. Organizations should treat this as a top priority, ensuring the H2 console is not publicly exposed and that all default credentials are removed before any further deployment.