H2 Database Console Remote Code Execution [Severity: Critical]

SonarQube Server / Community Build
,
2

Hey there.

  1. SonarQube v7.9.6 is an EOL version of SonarQube, you should upgrade to at least v8.9.6
  2. The H2 database is only used for evaluation purposes (when sonar.jdbc.url is not configured to a Postgres, Oracle, or Microosft SQL Server database). It is not production-ready, nor meant to be.
  3. Incidentally, we already plan to upgrade the H2 database in SonarQube v9.4 (SONAR-15845)
  4. In all versions, SonarQube is not vulnerable as the H2 console is not enabled and the H2 URL is hardcoded
  5. In the future, please follow our guide on Resonsible Vulnerabilty Disclosure