Improper input validation in Clickhouse Oss
CVE-2025-1385
When the library bridge feature is enabled, the clickhouse-library-bridge exposes an HTTP API on localhost. This allows clickhouse-server to dynamically load a library from a specified path and execute it in an isolated process. Combined with the ClickHouse table engine functionality that permits file uploads to specific directories, a misconfigured server can be exploited by an attacker with privilege to access to both table engines to execute arbitrary code on the ClickHouse server. You can check if your ClickHouse server is vulnerable to this vulnerability by inspecting the configuration file and confirming if the following setting is enabled: <library_bridge> <port>9019</port> </library_bridge>
Vulnerability class: Drupalgeddon 2 (CVE-2018-7600)
EPSS: 0.004 (35.2th percentile) — read the EPSS interpretation.
Affected products
- Clickhouse Oss — versions 24.3, 24.8, 24.11
Weakness classification (CWE)
Public proof-of-concept exploits
References
Frequently asked questions
- What is CVE-2025-1385?
- CVE-2025-1385 is a vulnerability in Clickhouse Oss, classified under Improper Input Validation. Published 2025-03-20.
- Is CVE-2025-1385 known to be exploited?
- 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.