Vulnerability · Published Mar 20, 2025 · Assigned by ClickHouse
CVE-2025-1385Fail input validation in clickhouse-library-bridge API could lead to RCE under specific configuration
High 7.5
In plain English
A high-severity improper input validation in ClickHouse OSS from ClickHouse. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 40% of all known vulnerabilities).
Official description
When the library bridge feature is enabled, the clickhouse-library-bridge exposes an HTTP API on localhost. This allows clickhouse-server to dynamically load a library from a specified path and execute it in an isolated process. Combined with the ClickHouse table engine functionality that permits file uploads to specific directories, a misconfigured server can be exploited by an attacker with privilege to access to both table engines to execute arbitrary code on the ClickHouse server. You can check if your ClickHouse server is vulnerable to this vulnerability by inspecting the configuration file and confirming if the following setting is enabled: <library_bridge> <port>9019</port> </library_bridge>
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu:24.04:LTS | clickhouse | no fix listed | UBUNTU-CVE-2025-1385 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| ClickHouse | ClickHouse OSS | 24.3 – before 24.3.18.624.8 – before 24.8.14.2724.11 – before 24.11.5.3424.12 – before 24.12.5.6525.1 – before 25.1.5.5 |
Weakness: CWE-20 · Vector: CVSS:4.0/AV:N/AC:H/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N