Cloudanix VulnDB

CVE-2023-47118

Critical · 9.8

CVSS

9.8

EPSS

0.5%

Published

Dec 20, 2023

CISA due date

—

Cloudanix analysis

Next patch cycle SSVC: Track

A bug in ClickHouse lets attackers crash the database server by sending specially crafted data over the network, causing sudden loss of access to reports and analytics until the system is restarted or updated.

Exploitation
Remote Unauthenticated
Attacker needs
None
Complexity
Low
Impact
Denial Of Service
Component
Application
Class
Memory Corruption
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Heap buffer overflow in T64 codec decompression logic on the unauthenticated native interface (port 9000/tcp) that crashes the ClickHouse server process.

Why it matters to the business

Remote unauthenticated denial of service against the database server leading to loss of analytical query capability and service availability; the flaw is reachable over the default native port and also via authenticated HTTP.

How an attack unfolds

An attacker sends a specially crafted payload to the native protocol endpoint that triggers the T64 decompression bug, causing an immediate process crash; the same malformed request can be delivered over HTTP after valid credentials are supplied.

How to fix it

Upgrade to one of the fixed releases: 23.10.2.13-stable, 23.9.4.11-stable, 23.8.6.16-lts, or 23.3.16.7-lts (corresponding to commit fb4125cc92af355f1839d5c8ae661af21aa7fed1). Restrict network access to the native interface until patching is complete.

How to confirm the fix worked

Verify the running server version against the fixed releases, confirm the commit hash fb4125cc92af355f1839d5c8ae661af21aa7fed1 is present, and test that crafted T64 payloads no longer cause crashes in a lab environment.

Typical attack path

  1. Connect to TCP port 9000 or issue an authenticated HTTP request
  2. Transmit a malicious payload targeting T64 codec decompression
  3. Trigger heap buffer overflow resulting in server process termination

How to detect it

Correlate ClickHouse server process crashes with inbound connections on port 9000 or authenticated HTTP requests; inspect logs for T64 codec decompression errors or abrupt terminations around the time of suspicious traffic.

What your security team should do

  • Apply the listed stable or LTS upgrade immediately
  • Block or heavily restrict inbound access to TCP 9000 from untrusted networks
  • Enable network segmentation and authentication requirements for the native protocol
  • Monitor for server crashes correlated with traffic on the native or HTTP interfaces

The record

ClickHouse® is an open-source column-oriented database management system that allows generating analytical data reports in real-time. A heap buffer overflow issue was discovered in ClickHouse server. An attacker could send a specially crafted payload to the native interface exposed by default on port 9000/tcp, triggering a bug in the decompression logic of T64 codec that crashes the ClickHouse server process. This attack does not require authentication. Note that this exploit can also be triggered via HTTP protocol, however, the attacker will need a valid credential as the HTTP authentication take places first. This issue has been fixed in version 23.10.2.13-stable, 23.9.4.11-stable, 23.8.6.16-lts and 23.3.16.7-lts.

Affected packages

Ecosystem Package Introduced Fixed
Debian:11 clickhouse 0 No fix
Debian:12 clickhouse 0 No fix
Ubuntu:20.04:LTS clickhouse 0 No fix
Ubuntu:24.04:LTS clickhouse 0 No fix
Ubuntu:Pro:20.04:LTS clickhouse 0 No fix

Related vulnerabilities