Collected research

Chaining Exposed Actuators and H2 Database Aliases in Spring Boot 2

Remote Code Execution in Three Acts: Chaining Exposed Actuators and H2 Database Aliases in Spring Boot 2

An exposed Spring Boot 2 actuator env endpoint lets an attacker set the HikariCP connection test query, which the pool runs as SQL on the next database connection. Against an H2 database that query can CREATE ALIAS a Java function and call it, giving remote code execution, with CONCAT and HEXTORAW string tricks to evade WAF filters.

Record

Document

Remote Code Execution in Three Acts: Chaining Exposed Actuators and H2 Database Aliases in Spring Boot 2

Published by

spaceraccoon.dev

Date

12 January 2020

Topic

Other

In the archive

• Collected in the 2020 research round

Related sources

• Exploiting Spring Boot Actuators
• Demonstration application
• Foundational H2 alias technique

Tags

• rce
• command-injection
• injection
• waf-bypass
• attack-chain
• spring
• java
• database
• case-study
• owasp-a03-2021
• owasp-a05-2021

This page is the archive's own catalogue record. The research is the work of spaceraccoon.dev, first published at the original source. Preserved copies are kept so the citation survives its host; this one was last captured on 9 August 2026.