Juggle <= 1.6.0 - Unauthenticated Exposed H2 Database Console

id: CVE-2026-67208

info:
  name: Juggle <= 1.6.0 - Unauthenticated Exposed H2 Database Console
  author: str4k3r
  severity: critical
  description: |
    Juggle ships the H2 database web console enabled and reachable from
    non-localhost by default. No application-level authentication covers
    the /h2-console path, and the shipped default datasource credentials
    (sa/juggle) are known. An unauthenticated remote attacker can reach the
    console and, using the default credentials, achieve OS command
    execution on the host via the H2 CREATE ALIAS Runtime.exec() technique.
  impact: |
    Unauthenticated remote attackers can execute arbitrary OS commands with root privileges, leading to full system compromise.
  remediation: |
    Update to the latest version and change default credentials; restrict access to /h2-console.
  reference:
    - https://github.com/somta/Juggle/issues/86
    - https://www.vulncheck.com/advisories/juggle-unauthenticated-rce-via-exposed-h2-console
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2026-67208
    epss-score: 0.05285
    epss-percentile: 0.92105
    cwe-id: CWE-306
  metadata:
    verified: true
    max-request: 2
    product: juggle
    vendor: somta
  tags: cve,cve2026,juggle,h2,exposure,unauth,rce

flow: |
  http("juggle-detect") && http("h2-console-check")

http:
  - method: GET
    id: juggle-detect
    path:
      - "{{BaseURL}}"

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 200'
          - 'contains(body, "<title>Juggle</title>")'
        condition: and
        internal: true

  - method: GET
    id: h2-console-check
    path:
      - "{{BaseURL}}/h2-console/"

    matchers-condition: and
    matchers:
      - type: status
        status:
          - 200
      - type: word
        part: body
        words:
          - "<title>H2 Console</title>"
          - "login.jsp?jsessionid="
        condition: and
# digest: 4a0a00473045022100f92d64d8d08662c53134bb5c563fa401edac2548a87480ed6210aafe6a2b7b28022044ff615d0666be8b24b092f0fa8e92aa7b6b0de7ee9286df31c2add11b173d04:922c64590222798bb761d5b6d8e72950