CVE-2024-22412 ClickHouse's Role-based Access Control is bypassed when query caching is enabled.

Low 2.4 Published 18 Mar 2024 Updated 1 Aug 2024

Attackers with role control can bypass access controls and read unauthorized data when query caching is enabled in ClickHouse.

Exploited in the wild: Not known
Login needed: An administrator
Attackable: Local or same network only
Victim action needed: Not needed
Fix: None listed

What is CVE-2024-22412?

CVE-2024-22412 is a low-severity missing authorization vulnerability in ClickHouse, published on 18 Mar 2024. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

ClickHouse is an open-source column-oriented database management system. A bug exists in the cloud ClickHouse offering prior to version 24.0.2.54535 and in github.com/clickhouse/clickhouse version 23.1. Query caching bypasses the role based access controls and the policies being enforced on roles. In affected versions, the query cache only respects separate users, however this is not documented and not expected behavior. People relying on ClickHouse roles can have their access control lists bypassed if they are using query caching. Attackers who have control of a role could guess queries and see data they shouldn't have access to. Version 24.1 of ClickHouse and version 24.0.2.54535 of ClickHouse Cloud contain a patch for this issue. Based on the documentation, role based access control should be enforced regardless if query caching is enabled or not.

Weakness: CWE-863

Which versions are affected by CVE-2024-22412?

It affects 2 products.

Products include Clickhouse Clickhouse, Clickhouse Clickhouse Cloud.

How do I fix CVE-2024-22412?

No fix has been published for CVE-2024-22412 yet. Limit exposure of the affected software until one is available.

Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.

Is CVE-2024-22412 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-22412 exists.

Sources

Also known as DEBIAN-CVE-2024-22412, ECHO-322b-5717-8504, GHSA-45h5-f7g3-gr8r, UBUNTU-CVE-2024-22412.