CVE-2024-22412
ClickHouse's Role-based Access Control is bypassed when query caching is enabled.
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
0Exploited in Wild
-Decision
Descriptions
ClickHouse is an open-source column-oriented database management system. A bug exists in the cloud ClickHouse offering prior to version 24.0.2.54535 and in github.com/clickhouse/clickhouse version 23.1. Query caching bypasses the role based access controls and the policies being enforced on roles. In affected versions, the query cache only respects separate users, however this is not documented and not expected behavior. People relying on ClickHouse roles can have their access control lists bypassed if they are using query caching. Attackers who have control of a role could guess queries and see data they shouldn't have access to. Version 24.1 of ClickHouse and version 24.0.2.54535 of ClickHouse Cloud contain a patch for this issue. Based on the documentation, role based access control should be enforced regardless if query caching is enabled or not.
ClickHouse es un sistema de gestión de bases de datos orientado a columnas de código abierto. Existe un error en la oferta de nube de ClickHouse anterior a la versión 24.0.2.54535 y en github.com/clickhouse/clickhouse versión 23.1. El almacenamiento en caché de consultas evita los controles de acceso basados en roles y las políticas que se aplican a los roles. En las versiones afectadas, la caché de consultas solo respeta a usuarios separados; sin embargo, esto no está documentado ni es un comportamiento esperado. Las personas que dependen de roles de ClickHouse pueden evitar sus listas de control de acceso si utilizan el almacenamiento en caché de consultas. Los atacantes que tienen control de una función podrían adivinar consultas y ver datos a los que no deberían tener acceso. La versión 24.1 de ClickHouse y la versión 24.0.2.54535 de ClickHouse Cloud contienen un parche para este problema. Según la documentación, se debe aplicar el control de acceso basado en roles independientemente de si el almacenamiento en caché de consultas está habilitado o no.
CVSS Scores
SSVC
- Decision:Track*
Timeline
- 2024-01-10 CVE Reserved
- 2024-03-18 CVE Published
- 2024-03-19 EPSS Updated
- 2024-08-01 CVE Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
- CWE-863: Incorrect Authorization
CAPEC
References (3)
| URL | Tag | Source |
|---|---|---|
| https://github.com/ClickHouse/ClickHouse/blob/bd17ee769e337906c4b1f404861e042ad72fcbfc/src/Interpreters/executeQuery.cpp#L1013-L1015 | X_refsource_misc | |
| https://github.com/ClickHouse/ClickHouse/pull/58611 | X_refsource_misc | |
| https://github.com/ClickHouse/ClickHouse/security/advisories/GHSA-45h5-f7g3-gr8r | X_refsource_confirm |
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| ClickHouse Search vendor "ClickHouse" | ClickHouse Search vendor "ClickHouse" for product "ClickHouse" | 23.1 Search vendor "ClickHouse" for product "ClickHouse" and version "23.1" | en |
Affected
| ||||||
| ClickHouse Search vendor "ClickHouse" | ClickHouse Search vendor "ClickHouse" for product "ClickHouse" | < 24.0.2.54535 Search vendor "ClickHouse" for product "ClickHouse" and version " < 24.0.2.54535" | en |
Affected
| ||||||