CVE-2024-23689: ClickHouse Client Certificate Password Exposure
Summary As initially reported in issue #1331, when client certificate authentication is enabled with password protection, the password (referred to as the client option sslkey) may be exposed in client exceptions (e.g., ClickHouseException or SQLException). This vulnerability can potentially lead to unauthorized access, data breaches, and violations of user privacy.
Details During the handling of ClickHouseException, the client certificate password may be inadvertently exposed when sslkey is specified. This issue can arise when an exception is thrown during the execution of a query or a database operation. The client certificate password is then included in the exception message, which could be logged or exposed to unauthorized parties.
Impact This vulnerability enables an attacker with access to client exception error messages or logs to obtain client certificate passwords, potentially allowing unauthorized access to sensitive information, data manipulation, and denial of service attacks. The extent of the risk depends on the specific implementation and usage of the affected systems. However, any exposure of client certificate passwords should be treated as a high-priority security concern.
Other sources
Exposure of sensitive information in exceptions in ClichHouse's clickhouse-r2dbc, com.clickhouse:clickhouse-jdbc, and com.clickhouse:clickhouse-client versions less than 0.4.6 allows unauthorized users to gain access to client certificate passwords via client exception logs. This occurs when 'sslkey' is specified and an exception, such as a ClickHouseException or SQLException, is thrown during database operations; the certificate password is then included in the logged exception message.
— NVD
Exposure of sensitive information in exceptions in ClickHouse's clickhouse-r2dbc, com.clickhouse:clickhouse-jdbc, and com.clickhouse:clickhouse-client versions less than 0.4.6 allows unauthorized users to gain access to client certificate passwords via client exception logs. This occurs when 'sslkey' is specified and an exception, such as a ClickHouseException or SQLException, is thrown during database operations; the certificate password is then included in the logged exception message.
— GitHub
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
maven/com.clickhouse:clickhouse-clientto a version that resolves this vulnerability.Fixed in 0.4.6 - Upgrade
Upgrade
maven/com.clickhouse:clickhouse-jdbcto a version that resolves this vulnerability.Fixed in 0.4.6 - Upgrade
Upgrade
maven/com.clickhouse:clickhouse-r2dbcto a version that resolves this vulnerability.Fixed in 0.4.6 - Upgrade
Upgrade
com.clickhouse:clickhouse-r2dbc / com.clickhouse:clickhouse-jdbc / com.clickhouse:clickhouse-clientto a version that resolves this vulnerability.Fixed in 0.4.6 - Configuration
If possible in your application, avoid setting the client certificate password via the client option `sslkey`; the issue occurs when `sslkey` is specified and an exception (e.g., ClickHouseException or SQLException) is thrown, causing the password to be included in logged exception messages.
ClickHouse client certificate authentication sslkey = unspecified/avoid when client certificate password protection is enabled - Compensating control
Treat client exception logs/error message outputs as sensitive: restrict access to logs that may contain client exception messages so unauthorized users cannot view exception details that may include the client certificate password.
Event History
Frequently Asked Questions
What is the severity of CVE-2024-23689?
CVE-2024-23689 is assessed to have a high severity due to the potential exposure of sensitive information.
How do I fix CVE-2024-23689?
To fix CVE-2024-23689, upgrade the affected software components to version 0.4.6 or later.
Which versions are affected by CVE-2024-23689?
CVE-2024-23689 affects versions of com.clickhouse:clickhouse-client, com.clickhouse:clickhouse-jdbc, and com.clickhouse:clickhouse-r2dbc that are lower than 0.4.6.
What kind of information is exposed in CVE-2024-23689?
CVE-2024-23689 allows unauthorized users to gain access to client certificate passwords via client exception logs.
What software components are involved in CVE-2024-23689?
CVE-2024-23689 involves com.clickhouse:clickhouse-client, com.clickhouse:clickhouse-jdbc, and com.clickhouse:clickhouse-r2dbc.