The ClickHouse library bridge is a powerful feature that allows the dynamic loading of libraries from specified paths and execution in isolated processes. However, with great power comes great responsibility, and when misconfigured, this feature can lead to arbitrary code execution by attackers, thus compromising a ClickHouse server.

This article will discuss the details of CVE-2025-1385, a vulnerability that exploits the library bridge feature in ClickHouse. We will look into how the vulnerability works, provide a code snippet demonstrating the exploit, and offer ideas on how to mitigate the risk.

Details of CVE-2025-1385

When the library bridge feature is enabled, the clickhouse-library-bridge exposes an HTTP API on localhost. This allows clickhouse-server to dynamically load a library from a specified path and execute it in an isolated process. Combined with the ClickHouse table engine functionality that permits file uploads to specific directories, a misconfigured server can be exploited by an attacker with privilege to access both table engines to execute arbitrary code on the ClickHouse server.

To check if your ClickHouse server is vulnerable to this vulnerability, inspect the configuration file and confirm if the following setting is enabled:

<library_bridge>
   <port>9019</port>
</library_bridge>

Exploit Details

The vulnerability occurs due to an issue in the library bridge HTTP API, which listens on a specified port (usually 9019). An attacker can create a table in ClickHouse using the table engine functionality to store the file with the malicious library. Then, by utilizing the library bridge feature, the attacker can instruct the ClickHouse server to load and execute the arbitrary code from the malicious library file.

Here is a code snippet demonstrating the exploit

# Attacker creates a table to store the malicious library
# Note: FileEngine is a hypothetical table engine used for demonstration purposes
$ clickhouse-client -q "CREATE TABLE exploit_table (code String) ENGINE = FileEngine('/path/to/malicious/library.so')"

# Attacker inserts the malicious code into the table
$ clickhouse-client -q "INSERT INTO exploit_table VALUES ('<malicious code>')"

# Attacker instructs ClickHouse server to load and execute the malicious library using the library bridge feature
$ curl -X POST http://localhost:9019/ -d '{"method": "load", "library_path": "/path/to/malicious/library.so"}'

To protect your ClickHouse server from this vulnerability, follow these recommendations

1. Disable the library bridge feature if it is not required by your use case. You can do this by removing the library_bridge configuration block from the ClickHouse configuration file.

2. Limit the privileges of users that can access and create tables using the table engine functionality in ClickHouse. This will help restrict who can utilize the file upload feature of table engines and reduce the risk of unauthorized code execution.

3. Regularly audit your ClickHouse server configurations to ensure they are secure and up-to-date with the latest security patches and best practices.

Conclusion

CVE-2025-1385 is a serious security vulnerability that can lead to arbitrary code execution on a ClickHouse server. By properly configuring the library bridge feature, limiting user privileges, and regularly auditing your server configurations, you can mitigate the risk of this vulnerability and keep your ClickHouse server secure.

Original References

- ClickHouse Official Documentation: Library Bridge
- CVE-2025-1385 Vulnerability Details

Timeline

Published on: 03/20/2025 08:15:11 UTC