CVE-2025-1385 (GCVE-0-2025-1385)
Vulnerability from cvelistv5 – Published: 2025-03-20 07:13 – Updated: 2025-03-20 15:10
VLAI?
Title
Fail input validation in clickhouse-library-bridge API could lead to RCE under specific configuration
Summary
When the library bridge feature is enabled, the clickhouse-library-bridge exposes an HTTP API on localhost. This allows clickhouse-server to dynamically load a library from a specified path and execute it in an isolated process. Combined with the ClickHouse table engine functionality that permits file uploads to specific directories, a misconfigured server can be exploited by an attacker with privilege to access to both table engines to execute arbitrary code on the ClickHouse server.
You can check if your ClickHouse server is vulnerable to this vulnerability by inspecting the configuration file and confirming if the following setting is enabled:
<library_bridge>
<port>9019</port>
</library_bridge>
Severity ?
CWE
- CWE-20 - Improper Input Validation
Assigner
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| ClickHouse | ClickHouse OSS |
Affected:
24.3 , < 24.3.18.6
(custom)
Affected: 24.8 , < 24.8.14.27 (custom) Affected: 24.11 , < 24.11.5.34 (custom) Affected: 24.12 , < 24.12.5.65 (custom) Affected: 25.1 , < 25.1.5.5 (custom) |
Credits
Arseniy Dugin
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-1385",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-03-20T15:10:22.165918Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-03-20T15:10:30.494Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://github.com/ClickHouse/clickhouse",
"defaultStatus": "unaffected",
"modules": [
"clickhouse-library-bridge"
],
"packageName": "ClickHouse",
"product": "ClickHouse OSS",
"repo": "https://github.com/ClickHouse/clickhouse",
"vendor": "ClickHouse",
"versions": [
{
"lessThan": "24.3.18.6",
"status": "affected",
"version": "24.3",
"versionType": "custom"
},
{
"lessThan": "24.8.14.27",
"status": "affected",
"version": "24.8",
"versionType": "custom"
},
{
"lessThan": "24.11.5.34",
"status": "affected",
"version": "24.11",
"versionType": "custom"
},
{
"lessThan": "24.12.5.65",
"status": "affected",
"version": "24.12",
"versionType": "custom"
},
{
"lessThan": "25.1.5.5",
"status": "affected",
"version": "25.1",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Arseniy Dugin"
}
],
"datePublic": "2025-03-20T02:00:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eWhen the library bridge feature is enabled, the clickhouse-library-bridge exposes an HTTP API on localhost. This allows clickhouse-server to dynamically load a library from a specified path and execute it in an isolated process. Combined with the ClickHouse table engine functionality that permits file uploads to specific directories, a misconfigured server can be exploited by an attacker with privilege to access to both table engines to execute arbitrary code on the ClickHouse server.\u003c/p\u003e\u003cp\u003eYou can check if your ClickHouse server is vulnerable to this vulnerability by inspecting the configuration file and confirming if the following setting is enabled:\u003c/p\u003e\u003cdiv\u003e\u003cpre\u003e\u003ccode\u003e\u0026lt;library_bridge\u0026gt;\n \u0026lt;port\u0026gt;9019\u0026lt;/port\u0026gt;\n\u0026lt;/library_bridge\u0026gt;\u003c/code\u003e\u003c/pre\u003e\u003c/div\u003e\u003cbr\u003e"
}
],
"value": "When the library bridge feature is enabled, the clickhouse-library-bridge exposes an HTTP API on localhost. This allows clickhouse-server to dynamically load a library from a specified path and execute it in an isolated process. Combined with the ClickHouse table engine functionality that permits file uploads to specific directories, a misconfigured server can be exploited by an attacker with privilege to access to both table engines to execute arbitrary code on the ClickHouse server.\n\nYou can check if your ClickHouse server is vulnerable to this vulnerability by inspecting the configuration file and confirming if the following setting is enabled:\n\n\u003clibrary_bridge\u003e\n \u003cport\u003e9019\u003c/port\u003e\n\u003c/library_bridge\u003e"
}
],
"impacts": [
{
"capecId": "CAPEC-108",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-108 Command Line Execution through SQL Injection"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "HIGH",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"privilegesRequired": "HIGH",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-20",
"description": "CWE-20 Improper Input Validation",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-03-20T07:13:34.577Z",
"orgId": "cb7ba516-3b07-4c98-b0c2-715220f1a8f6",
"shortName": "ClickHouse"
},
"references": [
{
"url": "https://github.com/ClickHouse/ClickHouse/security/advisories/GHSA-5phv-x8x4-83x5"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Fail input validation in clickhouse-library-bridge API could lead to RCE under specific configuration",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "cb7ba516-3b07-4c98-b0c2-715220f1a8f6",
"assignerShortName": "ClickHouse",
"cveId": "CVE-2025-1385",
"datePublished": "2025-03-20T07:13:34.577Z",
"dateReserved": "2025-02-17T02:21:00.085Z",
"dateUpdated": "2025-03-20T15:10:30.494Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1",
"vulnerability-lookup:meta": {
"vulnrichment": {
"containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2025-1385\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"total\"}], \"version\": \"2.0.3\", \"timestamp\": \"2025-03-20T15:10:22.165918Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2025-03-20T15:10:26.608Z\"}}], \"cna\": {\"title\": \"Fail input validation in clickhouse-library-bridge API could lead to RCE under specific configuration\", \"source\": {\"discovery\": \"UNKNOWN\"}, \"credits\": [{\"lang\": \"en\", \"type\": \"finder\", \"value\": \"Arseniy Dugin\"}], \"impacts\": [{\"capecId\": \"CAPEC-108\", \"descriptions\": [{\"lang\": \"en\", \"value\": \"CAPEC-108 Command Line Execution through SQL Injection\"}]}], \"metrics\": [{\"format\": \"CVSS\", \"cvssV4_0\": {\"Safety\": \"NOT_DEFINED\", \"version\": \"4.0\", \"Recovery\": \"NOT_DEFINED\", \"baseScore\": 7.5, \"Automatable\": \"NOT_DEFINED\", \"attackVector\": \"NETWORK\", \"baseSeverity\": \"HIGH\", \"valueDensity\": \"NOT_DEFINED\", \"vectorString\": \"CVSS:4.0/AV:N/AC:H/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N\", \"providerUrgency\": \"NOT_DEFINED\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"HIGH\", \"attackRequirements\": \"NONE\", \"privilegesRequired\": \"HIGH\", \"subIntegrityImpact\": \"NONE\", \"vulnIntegrityImpact\": \"HIGH\", \"subAvailabilityImpact\": \"NONE\", \"vulnAvailabilityImpact\": \"HIGH\", \"subConfidentialityImpact\": \"NONE\", \"vulnConfidentialityImpact\": \"HIGH\", \"vulnerabilityResponseEffort\": \"NOT_DEFINED\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"GENERAL\"}]}], \"affected\": [{\"repo\": \"https://github.com/ClickHouse/clickhouse\", \"vendor\": \"ClickHouse\", \"modules\": [\"clickhouse-library-bridge\"], \"product\": \"ClickHouse OSS\", \"versions\": [{\"status\": \"affected\", \"version\": \"24.3\", \"lessThan\": \"24.3.18.6\", \"versionType\": \"custom\"}, {\"status\": \"affected\", \"version\": \"24.8\", \"lessThan\": \"24.8.14.27\", \"versionType\": \"custom\"}, {\"status\": \"affected\", \"version\": \"24.11\", \"lessThan\": \"24.11.5.34\", \"versionType\": \"custom\"}, {\"status\": \"affected\", \"version\": \"24.12\", \"lessThan\": \"24.12.5.65\", \"versionType\": \"custom\"}, {\"status\": \"affected\", \"version\": \"25.1\", \"lessThan\": \"25.1.5.5\", \"versionType\": \"custom\"}], \"packageName\": \"ClickHouse\", \"collectionURL\": \"https://github.com/ClickHouse/clickhouse\", \"defaultStatus\": \"unaffected\"}], \"datePublic\": \"2025-03-20T02:00:00.000Z\", \"references\": [{\"url\": \"https://github.com/ClickHouse/ClickHouse/security/advisories/GHSA-5phv-x8x4-83x5\"}], \"x_generator\": {\"engine\": \"Vulnogram 0.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"When the library bridge feature is enabled, the clickhouse-library-bridge exposes an HTTP API on localhost. This allows clickhouse-server to dynamically load a library from a specified path and execute it in an isolated process. Combined with the ClickHouse table engine functionality that permits file uploads to specific directories, a misconfigured server can be exploited by an attacker with privilege to access to both table engines to execute arbitrary code on the ClickHouse server.\\n\\nYou can check if your ClickHouse server is vulnerable to this vulnerability by inspecting the configuration file and confirming if the following setting is enabled:\\n\\n\u003clibrary_bridge\u003e\\n \u003cport\u003e9019\u003c/port\u003e\\n\u003c/library_bridge\u003e\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"\u003cp\u003eWhen the library bridge feature is enabled, the clickhouse-library-bridge exposes an HTTP API on localhost. This allows clickhouse-server to dynamically load a library from a specified path and execute it in an isolated process. Combined with the ClickHouse table engine functionality that permits file uploads to specific directories, a misconfigured server can be exploited by an attacker with privilege to access to both table engines to execute arbitrary code on the ClickHouse server.\u003c/p\u003e\u003cp\u003eYou can check if your ClickHouse server is vulnerable to this vulnerability by inspecting the configuration file and confirming if the following setting is enabled:\u003c/p\u003e\u003cdiv\u003e\u003cpre\u003e\u003ccode\u003e\u0026lt;library_bridge\u0026gt;\\n \u0026lt;port\u0026gt;9019\u0026lt;/port\u0026gt;\\n\u0026lt;/library_bridge\u0026gt;\u003c/code\u003e\u003c/pre\u003e\u003c/div\u003e\u003cbr\u003e\", \"base64\": false}]}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-20\", \"description\": \"CWE-20 Improper Input Validation\"}]}], \"providerMetadata\": {\"orgId\": \"cb7ba516-3b07-4c98-b0c2-715220f1a8f6\", \"shortName\": \"ClickHouse\", \"dateUpdated\": \"2025-03-20T07:13:34.577Z\"}}}",
"cveMetadata": "{\"cveId\": \"CVE-2025-1385\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2025-03-20T15:10:30.494Z\", \"dateReserved\": \"2025-02-17T02:21:00.085Z\", \"assignerOrgId\": \"cb7ba516-3b07-4c98-b0c2-715220f1a8f6\", \"datePublished\": \"2025-03-20T07:13:34.577Z\", \"assignerShortName\": \"ClickHouse\"}",
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
}
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
Loading…