CVE-2021-43304
📋 TL;DR
CVE-2021-43304 is a heap buffer overflow vulnerability in ClickHouse's LZ4 compression codec that allows attackers to execute arbitrary code or cause denial of service by sending malicious queries. This affects ClickHouse database servers with the vulnerable compression codec enabled. Attackers can exploit this remotely without authentication.
💻 Affected Systems
- ClickHouse
📦 What is this software?
Clickhouse by Clickhouse
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to complete system compromise, data theft, or ransomware deployment.
Likely Case
Denial of service causing database crashes and service disruption.
If Mitigated
Limited impact if network segmentation and query validation are implemented.
🎯 Exploit Status
Public technical details available in the JFrog blog post. Exploitation requires sending specially crafted queries to vulnerable ClickHouse instances.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 21.10.2.15, 21.11.2.2, 21.12.2.1 or later
Vendor Advisory: https://github.com/ClickHouse/ClickHouse/security/advisories/GHSA-5rqg-4jv3-7whv
Restart Required: Yes
Instructions:
1. Identify current ClickHouse version. 2. Upgrade to patched version using official package manager. 3. Restart ClickHouse service. 4. Verify the fix is applied.
🔧 Temporary Workarounds
Disable LZ4 compression codec
allTemporarily disable the vulnerable LZ4 compression codec to prevent exploitation.
Modify ClickHouse configuration to remove or disable LZ4 codec support
Network access restrictions
linuxRestrict network access to ClickHouse ports (default 8123, 9000) to trusted sources only.
iptables -A INPUT -p tcp --dport 8123 -s trusted_ip -j ACCEPT
iptables -A INPUT -p tcp --dport 9000 -s trusted_ip -j ACCEPT
iptables -A INPUT -p tcp --dport 8123 -j DROP
iptables -A INPUT -p tcp --dport 9000 -j DROP
🧯 If You Can't Patch
- Implement strict network segmentation and firewall rules to limit ClickHouse access to trusted IPs only.
- Deploy web application firewall (WAF) or intrusion prevention system (IPS) with rules to detect and block malicious LZ4 compression patterns.
🔍 How to Verify
Check if Vulnerable:
Check ClickHouse version: SELECT version()Check Version:
clickhouse-client --query 'SELECT version()'Verify Fix Applied:
Verify version is 21.10.2.15, 21.11.2.2, 21.12.2.1 or later: SELECT version()📡 Detection & Monitoring
Log Indicators:
- Unexpected crashes or segmentation faults in ClickHouse logs
- Unusual query patterns with LZ4 compression
Network Indicators:
- Malformed queries to ClickHouse HTTP/HTTPS ports (8123) or native protocol port (9000)
SIEM Query:
source="clickhouse.log" AND ("segmentation fault" OR "buffer overflow" OR "LZ4")