HTTP API Exposure in ClickHouse Library Bridge by ClickHouse
CVE-2025-1385

7.5HIGH

Key Information:

Vendor

Clickhouse

Status
Clickhouse Oss
Vendor
CVE Published:
20 March 2025

What is CVE-2025-1385?

The library bridge feature in ClickHouse can pose security risks when it is enabled. This feature exposes an HTTP API on localhost, allowing the clickhouse-server to load libraries from specified paths and execute them within isolated processes. If a server is misconfigured, attackers with access to certain table engines may exploit this to execute arbitrary code. It's crucial to inspect the configuration file to determine whether the library bridge is enabled, particularly by checking for the specific setting that exposes port 9019.

Affected Version(s)

ClickHouse OSS 24.3 < 24.3.18.6

ClickHouse OSS 24.8 < 24.8.14.27

ClickHouse OSS 24.11 < 24.11.5.34

References

https://github.com/ClickHouse/ClickHouse/security/advisor...

CVSS V4

Score:
7.5
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Arseniy Dugin
.