Search

Find a vulnerability

Search criteria ⓘ Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.

    2 vulnerabilities found for ClickHouse OSS by ClickHouse

    CVE-2025-1385 (GCVE-0-2025-1385)

    Vulnerability from cvelistv5 – Published: 2025-03-20 07:13 – Updated: 2025-03-20 15:10
    VLAI
    Title
    Fail input validation in clickhouse-library-bridge API could lead to RCE under specific configuration
    Summary
    When the library bridge feature is enabled, the clickhouse-library-bridge exposes an HTTP API on localhost. This allows clickhouse-server to dynamically load a library from a specified path and execute it in an isolated process. Combined with the ClickHouse table engine functionality that permits file uploads to specific directories, a misconfigured server can be exploited by an attacker with privilege to access to both table engines to execute arbitrary code on the ClickHouse server. You can check if your ClickHouse server is vulnerable to this vulnerability by inspecting the configuration file and confirming if the following setting is enabled: <library_bridge> <port>9019</port> </library_bridge>
    Severity
    7.5 (High)
    CVSS:4.0/AV:N/AC:H/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
    SSVC
    Exploitation: none Automatable: no Technical Impact: total
    CISA Coordinator (v2.0.3)
    CWE
    • CWE-20 - Improper Input Validation
    Assigner
    References
    Impacted products
    Vendor Product Version
    ClickHouse ClickHouse OSS Affected: 24.3 , < 24.3.18.6 (custom)
    Affected: 24.8 , < 24.8.14.27 (custom)
    Affected: 24.11 , < 24.11.5.34 (custom)
    Affected: 24.12 , < 24.12.5.65 (custom)
    Affected: 25.1 , < 25.1.5.5 (custom)
    		Create a notification for this product.
    Date Public
    2025-03-20 02:00
    Credits
    Arseniy Dugin
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-1385",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-03-20T15:10:22.165918Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-03-20T15:10:30.494Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://github.com/ClickHouse/clickhouse",
          "defaultStatus": "unaffected",
          "modules": [
            "clickhouse-library-bridge"
          ],
          "packageName": "ClickHouse",
          "product": "ClickHouse OSS",
          "repo": "https://github.com/ClickHouse/clickhouse",
          "vendor": "ClickHouse",
          "versions": [
            {
              "lessThan": "24.3.18.6",
              "status": "affected",
              "version": "24.3",
              "versionType": "custom"
            },
            {
              "lessThan": "24.8.14.27",
              "status": "affected",
              "version": "24.8",
              "versionType": "custom"
            },
            {
              "lessThan": "24.11.5.34",
              "status": "affected",
              "version": "24.11",
              "versionType": "custom"
            },
            {
              "lessThan": "24.12.5.65",
              "status": "affected",
              "version": "24.12",
              "versionType": "custom"
            },
            {
              "lessThan": "25.1.5.5",
              "status": "affected",
              "version": "25.1",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Arseniy Dugin"
        }
      ],
      "datePublic": "2025-03-20T02:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eWhen the library bridge feature is enabled, the clickhouse-library-bridge exposes an HTTP API on localhost. This allows clickhouse-server to dynamically load a library from a specified path and execute it in an isolated process. Combined with the ClickHouse table engine functionality that permits file uploads to specific directories, a misconfigured server can be exploited by an attacker with privilege to access to both table engines to execute arbitrary code on the ClickHouse server.\u003c/p\u003e\u003cp\u003eYou can check if your ClickHouse server is vulnerable to this vulnerability by inspecting the configuration file and confirming if the following setting is enabled:\u003c/p\u003e\u003cdiv\u003e\u003cpre\u003e\u003ccode\u003e\u0026lt;library_bridge\u0026gt;\n   \u0026lt;port\u0026gt;9019\u0026lt;/port\u0026gt;\n\u0026lt;/library_bridge\u0026gt;\u003c/code\u003e\u003c/pre\u003e\u003c/div\u003e\u003cbr\u003e"
            }
          ],
          "value": "When the library bridge feature is enabled, the clickhouse-library-bridge exposes an HTTP API on localhost. This allows clickhouse-server to dynamically load a library from a specified path and execute it in an isolated process. Combined with the ClickHouse table engine functionality that permits file uploads to specific directories, a misconfigured server can be exploited by an attacker with privilege to access to both table engines to execute arbitrary code on the ClickHouse server.\n\nYou can check if your ClickHouse server is vulnerable to this vulnerability by inspecting the configuration file and confirming if the following setting is enabled:\n\n\u003clibrary_bridge\u003e\n   \u003cport\u003e9019\u003c/port\u003e\n\u003c/library_bridge\u003e"
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-108",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-108 Command Line Execution through SQL Injection"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "HIGH",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "privilegesRequired": "HIGH",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-20",
              "description": "CWE-20 Improper Input Validation",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-03-20T07:13:34.577Z",
        "orgId": "cb7ba516-3b07-4c98-b0c2-715220f1a8f6",
        "shortName": "ClickHouse"
      },
      "references": [
        {
          "url": "https://github.com/ClickHouse/ClickHouse/security/advisories/GHSA-5phv-x8x4-83x5"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Fail input validation in clickhouse-library-bridge API could lead to RCE under specific configuration",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "cb7ba516-3b07-4c98-b0c2-715220f1a8f6",
    "assignerShortName": "ClickHouse",
    "cveId": "CVE-2025-1385",
    "datePublished": "2025-03-20T07:13:34.577Z",
    "dateReserved": "2025-02-17T02:21:00.085Z",
    "dateUpdated": "2025-03-20T15:10:30.494Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

    CVE-2025-1385 (GCVE-0-2025-1385)

    Vulnerability from nvd – Published: 2025-03-20 07:13 – Updated: 2025-03-20 15:10
    VLAI
    Title
    Fail input validation in clickhouse-library-bridge API could lead to RCE under specific configuration
    Summary
    When the library bridge feature is enabled, the clickhouse-library-bridge exposes an HTTP API on localhost. This allows clickhouse-server to dynamically load a library from a specified path and execute it in an isolated process. Combined with the ClickHouse table engine functionality that permits file uploads to specific directories, a misconfigured server can be exploited by an attacker with privilege to access to both table engines to execute arbitrary code on the ClickHouse server. You can check if your ClickHouse server is vulnerable to this vulnerability by inspecting the configuration file and confirming if the following setting is enabled: <library_bridge> <port>9019</port> </library_bridge>
    Severity
    7.5 (High)
    CVSS:4.0/AV:N/AC:H/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
    SSVC
    Exploitation: none Automatable: no Technical Impact: total
    CISA Coordinator (v2.0.3)
    CWE
    • CWE-20 - Improper Input Validation
    Assigner
    References
    Impacted products
    Vendor Product Version
    ClickHouse ClickHouse OSS Affected: 24.3 , < 24.3.18.6 (custom)
    Affected: 24.8 , < 24.8.14.27 (custom)
    Affected: 24.11 , < 24.11.5.34 (custom)
    Affected: 24.12 , < 24.12.5.65 (custom)
    Affected: 25.1 , < 25.1.5.5 (custom)
    		Create a notification for this product.
    Date Public
    2025-03-20 02:00
    Credits
    Arseniy Dugin
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-1385",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-03-20T15:10:22.165918Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-03-20T15:10:30.494Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://github.com/ClickHouse/clickhouse",
          "defaultStatus": "unaffected",
          "modules": [
            "clickhouse-library-bridge"
          ],
          "packageName": "ClickHouse",
          "product": "ClickHouse OSS",
          "repo": "https://github.com/ClickHouse/clickhouse",
          "vendor": "ClickHouse",
          "versions": [
            {
              "lessThan": "24.3.18.6",
              "status": "affected",
              "version": "24.3",
              "versionType": "custom"
            },
            {
              "lessThan": "24.8.14.27",
              "status": "affected",
              "version": "24.8",
              "versionType": "custom"
            },
            {
              "lessThan": "24.11.5.34",
              "status": "affected",
              "version": "24.11",
              "versionType": "custom"
            },
            {
              "lessThan": "24.12.5.65",
              "status": "affected",
              "version": "24.12",
              "versionType": "custom"
            },
            {
              "lessThan": "25.1.5.5",
              "status": "affected",
              "version": "25.1",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Arseniy Dugin"
        }
      ],
      "datePublic": "2025-03-20T02:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eWhen the library bridge feature is enabled, the clickhouse-library-bridge exposes an HTTP API on localhost. This allows clickhouse-server to dynamically load a library from a specified path and execute it in an isolated process. Combined with the ClickHouse table engine functionality that permits file uploads to specific directories, a misconfigured server can be exploited by an attacker with privilege to access to both table engines to execute arbitrary code on the ClickHouse server.\u003c/p\u003e\u003cp\u003eYou can check if your ClickHouse server is vulnerable to this vulnerability by inspecting the configuration file and confirming if the following setting is enabled:\u003c/p\u003e\u003cdiv\u003e\u003cpre\u003e\u003ccode\u003e\u0026lt;library_bridge\u0026gt;\n   \u0026lt;port\u0026gt;9019\u0026lt;/port\u0026gt;\n\u0026lt;/library_bridge\u0026gt;\u003c/code\u003e\u003c/pre\u003e\u003c/div\u003e\u003cbr\u003e"
            }
          ],
          "value": "When the library bridge feature is enabled, the clickhouse-library-bridge exposes an HTTP API on localhost. This allows clickhouse-server to dynamically load a library from a specified path and execute it in an isolated process. Combined with the ClickHouse table engine functionality that permits file uploads to specific directories, a misconfigured server can be exploited by an attacker with privilege to access to both table engines to execute arbitrary code on the ClickHouse server.\n\nYou can check if your ClickHouse server is vulnerable to this vulnerability by inspecting the configuration file and confirming if the following setting is enabled:\n\n\u003clibrary_bridge\u003e\n   \u003cport\u003e9019\u003c/port\u003e\n\u003c/library_bridge\u003e"
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-108",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-108 Command Line Execution through SQL Injection"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "HIGH",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "privilegesRequired": "HIGH",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-20",
              "description": "CWE-20 Improper Input Validation",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-03-20T07:13:34.577Z",
        "orgId": "cb7ba516-3b07-4c98-b0c2-715220f1a8f6",
        "shortName": "ClickHouse"
      },
      "references": [
        {
          "url": "https://github.com/ClickHouse/ClickHouse/security/advisories/GHSA-5phv-x8x4-83x5"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Fail input validation in clickhouse-library-bridge API could lead to RCE under specific configuration",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "cb7ba516-3b07-4c98-b0c2-715220f1a8f6",
    "assignerShortName": "ClickHouse",
    "cveId": "CVE-2025-1385",
    "datePublished": "2025-03-20T07:13:34.577Z",
    "dateReserved": "2025-02-17T02:21:00.085Z",
    "dateUpdated": "2025-03-20T15:10:30.494Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}