CVE-2025-1385: Fail input validation in clickhouse-library-bridge API could lead to RCE under specific configuration

Vulnerability summary

CVE-2025-1385 is a high (CVSS 7.5) Improper Input Validation vulnerability in clickhouse clickhouse oss. EPSS estimates a 0.46% chance of exploitation in the next 30 days, higher than 39.2% of scored vulnerabilities.

Timeline

1. 20-03-2025
   PublishedVulnerability first disclosed.
2. 20-03-2025
   Last modifiedVulnerability information updated.

Description

When the library bridge feature is enabled, the clickhouse-library-bridge exposes an HTTP API on localhost. This allows clickhouse-server to dynamically load a library from a specified path and execute it in an isolated process. Combined with the ClickHouse table engine functionality that permits file uploads to specific directories, a misconfigured server can be exploited by an attacker with privilege to access to both table engines to execute arbitrary code on the ClickHouse server. You can check if your ClickHouse server is vulnerable to this vulnerability by inspecting the configuration file and confirming if the following setting is enabled: <library_bridge> <port>9019</port> </library_bridge>

• CWE-20Improper Input ValidationThe product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.