CVE-2022-41853

What it actually does

Remote code execution via arbitrary static method invocation on Java classes in classpath through java.sql.Statement or PreparedStatement when processing untrusted input.

Why it matters to the business

Full server compromise enabling data theft, persistence, or further lateral movement; increasing exploit probability raises urgency for database-dependent applications despite low KEV status.

How an attack unfolds

An attacker supplies malicious SQL containing static method calls (e.g., Runtime.exec) to an exposed hsqldb instance; by default any classpath class is reachable, resulting in code execution without authentication.

How to fix it

Upgrade to hsqldb 2.7.1; alternatively set system property hsqldb.method_class_names to a restrictive list such as java.lang.Math only via -Dhsqldb.method_class_names="java.lang.Math" or equivalent code.

How to confirm the fix worked

Verify installed hsqldb version is 2.7.1 or later; confirm the hsqldb.method_class_names property is configured and only permitted classes are reachable.

Typical attack path

1. Identify publicly reachable hsqldb endpoint accepting SQL
2. Craft SQL statement invoking static methods from allowed classes
3. Trigger method execution to spawn processes or alter system state
4. Establish foothold for data exfiltration or ransomware deployment

How to detect it

Review database query logs for unusual static method invocations; inspect process creation events originating from the Java/hsqldb process; search application logs for references to method_class_names changes.

• hsqldb.method_class_names
• java.sql.Statement
• java.sql.PreparedStatement
• Runtime.getRuntime

What your security team should do

• Immediately upgrade all hsqldb instances to 2.7.1
• Apply the restrictive method_class_names property as a compensating control
• Audit exposed database endpoints and restrict network access
• Monitor EPSS trend for continued increase and reassess priority