CVE-2023-47118
published 2023-12-20CVE-2023-47118: ClickHouse® is an open-source column-oriented database management system that allows generating analytical data reports in real-time. A heap buffer overflow…
PriorityP260critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
EPSS
0.46%
36.6th percentile
ClickHouse® is an open-source column-oriented database management system that allows generating analytical data reports in real-time. A heap buffer overflow issue was discovered in ClickHouse server. An attacker could send a specially crafted payload to the native interface exposed by default on port 9000/tcp, triggering a bug in the decompression logic of T64 codec that crashes the ClickHouse server process. This attack does not require authentication. Note that this exploit can also be triggered via HTTP protocol, however, the attacker will need a valid credential as the HTTP authentication take places first. This issue has been fixed in version 23.10.2.13-stable, 23.9.4.11-stable, 23.8.6.16-lts and 23.3.16.7-lts.
Affected
12 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| clickhouse | clickhouse | <= 23.10.2.14 | — |
| clickhouse | clickhouse | >= 23.10 < 23.10.2.13 | 23.10.2.13 |
| clickhouse | clickhouse | 23.10 – 23.10.4.25 | — |
| clickhouse | clickhouse | >= 23.3 < 23.3.16.7 | 23.3.16.7 |
| clickhouse | clickhouse | 23.3 – 23.3.17.13 | — |
| clickhouse | clickhouse | >= 23.8 < 23.8.6.16 | 23.8.6.16 |
| clickhouse | clickhouse | 23.8 – 23.8.7.24 | — |
| clickhouse | clickhouse | >= 23.9 < 23.9.4.11 | 23.9.4.11 |
| clickhouse | clickhouse | 23.9 – 23.9.5.29 | — |
| clickhouse | clickhouse_cloud | < 23.9.2.47475 | 23.9.2.47475 |
| clickhouse | clickhouse_cloud | 23.9 – 23.9.2.47475 | — |
| debian | clickhouse | — | — |
Detection & IOCsextracted from sources · hover to see the quote
- →Monitor for unauthenticated connections to ClickHouse native interface on port 9000/tcp delivering crafted decompression payloads targeting the T64 codec ↗
- →Also monitor HTTP-based exploitation attempts against ClickHouse — requires valid credentials but the same T64 decompression bug can be triggered over HTTP ↗
- →Alert on ClickHouse server process crashes (stack buffer overflow / heap buffer overflow) as a potential indicator of active exploitation of T64 or FPC codec decompression bugs ↗
- ·Fixed versions for CVE-2023-47118 are 23.10.2.13-stable, 23.9.4.11-stable, 23.8.6.16-lts, and 23.3.16.7-lts — detections are only relevant on unpatched instances ↗
- ·HTTP-based exploitation of CVE-2023-47118 requires valid credentials (authentication occurs before the vulnerable decompression path is reached), reducing unauthenticated HTTP attack surface ↗
CVSS provenance
nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
osv9.8CRITICAL
vendor_debian7.0LOW
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Debian
CVE-2023-48298: clickhouse - ClickHouse® is an open-source column-oriented database management system that al...
vendor_debian·2023·CVSS 7.0
CVE-2023-48298 [HIGH] CVE-2023-48298: clickhouse - ClickHouse® is an open-source column-oriented database management system that al...
ClickHouse® is an open-source column-oriented database management system that allows generating analytical data reports in real-time. This vulnerability is an integer underflow resulting in crash due to stack buffer overflow in decompression of FPC codec. It can be triggered and exploited by an unauthenticated attacker. The vulnerability is very similar to CVE-2023-47118 with how the vulnerable function can be exploited.
Scope: local
bookworm: resolved
bullseye: resolved
Debian
CVE-2023-47118: clickhouse - ClickHouse® is an open-source column-oriented database management system that al...
vendor_debian·2023·CVSS 7.0
CVE-2023-47118 [HIGH] CVE-2023-47118: clickhouse - ClickHouse® is an open-source column-oriented database management system that al...
ClickHouse® is an open-source column-oriented database management system that allows generating analytical data reports in real-time. A heap buffer overflow issue was discovered in ClickHouse server. An attacker could send a specially crafted payload to the native interface exposed by default on port 9000/tcp, triggering a bug in the decompression logic of T64 codec that crashes the ClickHouse server process. This attack does not require authentication. Note that this exploit can also be triggered via HTTP protocol, however, the attacker will need a valid credential as the HTTP authentication take places first. This issue has been fixed in version 23.10.2.13-stable, 23.9.4.11-stable, 23.8.6.16-lts and 23.3.16.7-lts.
Scope: local
bookworm: resolved
bullseye: resolved
OSV
CVE-2023-48298: ClickHouse® is an open-source column-oriented database management system that allows generating analytical data reports in real-time
osv·2023-12-21·CVSS 9.8
CVE-2023-48298 [CRITICAL] CVE-2023-48298: ClickHouse® is an open-source column-oriented database management system that allows generating analytical data reports in real-time
ClickHouse® is an open-source column-oriented database management system that allows generating analytical data reports in real-time. This vulnerability is an integer underflow resulting in crash due to stack buffer overflow in decompression of FPC codec. It can be triggered and exploited by an unauthenticated attacker. The vulnerability is very similar to CVE-2023-47118 with how the vulnerable function can be exploited.
OSV
CVE-2023-47118: ClickHouse® is an open-source column-oriented database management system that allows generating analytical data reports in real-time
osv·2023-12-20·CVSS 9.8
CVE-2023-47118 [CRITICAL] CVE-2023-47118: ClickHouse® is an open-source column-oriented database management system that allows generating analytical data reports in real-time
ClickHouse® is an open-source column-oriented database management system that allows generating analytical data reports in real-time. A heap buffer overflow issue was discovered in ClickHouse server. An attacker could send a specially crafted payload to the native interface exposed by default on port 9000/tcp, triggering a bug in the decompression logic of T64 codec that crashes the ClickHouse server process. This attack does not require authentication. Note that this exploit can also be triggered via HTTP protocol, however, the attacker will need a valid credential as the HTTP authentication take places first. This issue has been fixed in version 23.10.2.13-stable, 23.9.4.11-stable, 23.8.6.16-lts and 23.3.16.7-lts.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2023-12-20
Published