CVE-2025-1385
Fail input validation in clickhouse-library-bridge API could lead to RCE under specific configuration
- State
- Published
- Severity
- 7.5 High
- Published
- Mar 20, 2025
- Updated
- Mar 20, 2025
- Reserved
- Feb 17, 2025
Description
When the library bridge feature is enabled, the clickhouse-library-bridge exposes an HTTP API on localhost. This allows clickhouse-server to dynamically load a library from a specified path and execute it in an isolated process. Combined with the ClickHouse table engine functionality that permits file uploads to specific directories, a misconfigured server can be exploited by an attacker with privilege to access to both table engines to execute arbitrary code on the ClickHouse server.
You can check if your ClickHouse server is vulnerable to this vulnerability by inspecting the configuration file and confirming if the following setting is enabled:
<library_bridge> <port>9019</port> </library_bridge>
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 7.5 High | CVSS:4.0/AV:N/AC:H/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N | ClickHouse |
Weaknesses
- CWE-20 Improper Input Validation
Affected Products
| Product | Versions |
|---|---|
ClickHouse OSSClickHouse |
|
References
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.