CVE-2025-1385: Fail input validation in clickhouse-library-bridge API could lead to RCE under specific configuration
When the library bridge feature is enabled, the clickhouse-library-bridge exposes an HTTP API on localhost. This allows clickhouse-server to dynamically load a library from a specified path and execute it in an isolated process. Combined with the ClickHouse table engine functionality that permits file uploads to specific directories, a misconfigured server can be exploited by an attacker with privilege to access to both table engines to execute arbitrary code on the ClickHouse server.
You can check if your ClickHouse server is vulnerable to this vulnerability by inspecting the configuration file and confirming if the following setting is enabled:
<librarybridge> <port>9019</port> </librarybridge>
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-1385?
CVE-2025-1385 has been classified with a high severity rating due to the potential for remote code execution.
How do I fix CVE-2025-1385?
To fix CVE-2025-1385, disable the library bridge feature in the ClickHouse configuration.
Who is affected by CVE-2025-1385?
Users of ClickHouse with the library bridge feature enabled are affected by CVE-2025-1385.
What versions of ClickHouse are impacted by CVE-2025-1385?
All versions of ClickHouse that support the library bridge feature are potentially vulnerable to CVE-2025-1385.
What are the potential consequences of CVE-2025-1385?
Exploiting CVE-2025-1385 could allow an attacker to execute arbitrary code on the ClickHouse server.