CVE-2025-1385
Description
When the library bridge feature is enabled, the clickhouse-library-bridge exposes an HTTP API on localhost. This allows clickhouse-server to dynamically load a library from a specified path and execute it in an isolated process. Combined with the ClickHouse table engine functionality that permits file uploads to specific directories, a misconfigured server can be exploited by an attacker with privilege to access to both table engines to execute arbitrary code on the ClickHouse server. You can check if your ClickHouse server is vulnerable to this vulnerability by inspecting the configuration file and confirming if the following setting is enabled: <library_bridge> <port>9019</port> </library_bridge>
How to fix
- ClickHouse ClickHouse OSS24.3.18.6, 24.8.14.27, 24.11.5.34, 24.12.5.65, 25.1.5.5 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| ClickHouse ClickHouse OSS | 24.3 ≤ v < 24.3.18.6, 24.8 ≤ v < 24.8.14.27, 24.11 ≤ v < 24.11.5.34, 24.12 ≤ v < 24.12.5.65, 25.1 ≤ v < 25.1.5.5 | 24.3.18.6, 24.8.14.27, 24.11.5.34, 24.12.5.65, 25.1.5.5 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.