Vulnerability Description
ClickHouse is an open-source column-oriented database management system. A bug exists in the cloud ClickHouse offering prior to version 24.0.2.54535 and in github.com/clickhouse/clickhouse version 23.1. Query caching bypasses the role based access controls and the policies being enforced on roles. In affected versions, the query cache only respects separate users, however this is not documented and not expected behavior. People relying on ClickHouse roles can have their access control lists bypassed if they are using query caching. Attackers who have control of a role could guess queries and see data they shouldn't have access to. Version 24.1 of ClickHouse and version 24.0.2.54535 of ClickHouse Cloud contain a patch for this issue. Based on the documentation, role based access control should be enforced regardless if query caching is enabled or not.
CVSS Score
LOW
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Clickhouse | Clickhouse | >= 23.3.0.0, < 23.3.22.3 |
| Clickhouse | Clickhouse Cloud | < 24.0.2.54535 |
Related Weaknesses (CWE)
References
- https://github.com/ClickHouse/ClickHouse/blob/bd17ee769e337906c4b1f404861e042ad7Product
- https://github.com/ClickHouse/ClickHouse/pull/58611Issue TrackingPatch
- https://github.com/ClickHouse/ClickHouse/security/advisories/GHSA-45h5-f7g3-gr8rVendor AdvisoryExploit
- https://github.com/ClickHouse/ClickHouse/blob/bd17ee769e337906c4b1f404861e042ad7Product
- https://github.com/ClickHouse/ClickHouse/pull/58611Issue TrackingPatch
- https://github.com/ClickHouse/ClickHouse/security/advisories/GHSA-45h5-f7g3-gr8rVendor AdvisoryExploit
FAQ
What is CVE-2024-22412?
CVE-2024-22412 is a vulnerability with a CVSS score of 2.4 (LOW). ClickHouse is an open-source column-oriented database management system. A bug exists in the cloud ClickHouse offering prior to version 24.0.2.54535 and in github.com/clickhouse/clickhouse version 23....
How severe is CVE-2024-22412?
CVE-2024-22412 has been rated LOW with a CVSS base score of 2.4/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2024-22412?
Check the references section above for vendor advisories and patch information. Affected products include: Clickhouse Clickhouse, Clickhouse Clickhouse Cloud.