Cloudanix VulnDB

CVE-2023-48704

High · 7.5

CVSS

7.5

EPSS

0.5%

Published

Dec 22, 2023

CISA due date

—

Cloudanix analysis

Next patch cycle SSVC: Track

Attackers can remotely crash a ClickHouse database server by sending a single malicious message, stopping analytics work until the server is restarted.

Exploitation
Remote Unauthenticated
Attacker needs
None
Complexity
Low
Impact
Denial Of Service
Component
Application
Class
Memory Corruption
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Heap buffer overflow in the Gorilla codec decompression logic of the ClickHouse native protocol handler, resulting in process crash due to memory corruption.

Why it matters to the business

Successful exploitation causes denial of service against real-time analytical workloads, interrupting report generation and data ingestion until the server is restarted; widespread use of the affected open-source component amplifies operational disruption risk.

How an attack unfolds

An unauthenticated attacker connects to the ClickHouse native interface on TCP port 9000 and transmits a malformed compressed block crafted to trigger an out-of-bounds write inside the Gorilla codec decompressor, causing an immediate server crash.

How to fix it

Upgrade ClickHouse to version 23.10.5.20, 23.3.18.15, 23.8.8.20, 23.9.6.20 or later; for source builds apply commit cf7e84bb8cf809466615d6d52396ae3db6f7ede6. Restrict network access to port 9000 to trusted clients only until patched.

How to confirm the fix worked

Confirm server version string matches a fixed release; replay a known benign compressed block and verify absence of crash; monitor process stability under load after upgrade.

Typical attack path

  1. Scan for publicly reachable ClickHouse instances listening on TCP 9000
  2. Establish unauthenticated connection to the native protocol endpoint
  3. Transmit specially crafted Gorilla-compressed payload
  4. Trigger heap buffer overflow leading to process termination

How to detect it

Inspect ClickHouse server logs for abrupt termination entries around decompression routines; correlate with inbound connections on TCP 9000 that lack valid protocol handshakes; look for repeated crash/restart cycles in process supervision logs.

What your security team should do

  • Apply the listed fixed versions immediately given the unauthenticated remote attack surface
  • Place ClickHouse native ports behind network ACLs or authentication proxies
  • Enable process monitoring and automatic restart for the ClickHouse server
  • Review and minimize exposure of the native interface in production environments

The record

ClickHouse is an open-source column-oriented database management system that allows generating analytical data reports in real-time. A heap buffer overflow issue was discovered in ClickHouse server. An attacker could send a specially crafted payload to the native interface exposed by default on port 9000/tcp, triggering a bug in the decompression logic of Gorilla codec that crashes the ClickHouse server process. This attack does not require authentication. This issue has been addressed in ClickHouse Cloud version 23.9.2.47551 and ClickHouse versions 23.10.5.20, 23.3.18.15, 23.8.8.20, and 23.9.6.20.

Affected packages

Ecosystem Package Introduced Fixed
Debian:11 clickhouse 0 No fix
Debian:12 clickhouse 0 No fix
Ubuntu:20.04:LTS clickhouse 0 No fix
Ubuntu:24.04:LTS clickhouse 0 No fix
Ubuntu:Pro:20.04:LTS clickhouse 0 No fix

Related vulnerabilities