CVE-2022-44010
📋 TL;DR
This vulnerability allows unauthenticated attackers to send crafted HTTP requests to ClickHouse's HTTP endpoint (port 8123), causing a heap-based buffer overflow that crashes the ClickHouse process. All ClickHouse servers with the HTTP interface exposed are affected, particularly those running versions before the fixed releases.
💻 Affected Systems
- ClickHouse
📦 What is this software?
Clickhouse by Clickhouse
Clickhouse by Clickhouse
Clickhouse by Clickhouse
Clickhouse by Clickhouse
Clickhouse by Clickhouse
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to complete system compromise, though the CVE description only confirms denial of service via process crash.
Likely Case
Denial of service through ClickHouse process crash, disrupting database operations.
If Mitigated
Minimal impact if HTTP endpoint is not exposed or protected by network controls.
🎯 Exploit Status
The vulnerability is in the HTTP endpoint parser, making exploitation straightforward for attackers with network access.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 22.9.1.2603, 22.8.2.11, 22.7.4.16, 22.6.6.16, or 22.3.12.19
Vendor Advisory: https://clickhouse.com/docs/en/whats-new/security-changelog
Restart Required: Yes
Instructions:
1. Identify your ClickHouse version. 2. Upgrade to one of the fixed versions using your package manager (apt/yum) or download from official repository. 3. Restart ClickHouse service.
🔧 Temporary Workarounds
Block HTTP endpoint access
linuxRestrict network access to port 8123 using firewall rules.
sudo iptables -A INPUT -p tcp --dport 8123 -j DROP
sudo ufw deny 8123
Disable HTTP interface
allConfigure ClickHouse to disable the HTTP interface entirely.
Edit /etc/clickhouse-server/config.xml and set <http_port>0</http_port> or comment out HTTP configuration
🧯 If You Can't Patch
- Implement strict network segmentation to isolate ClickHouse HTTP endpoint from untrusted networks
- Deploy a web application firewall (WAF) or reverse proxy in front of ClickHouse to filter malicious HTTP requests
🔍 How to Verify
Check if Vulnerable:
Check ClickHouse version and compare with affected versions. If version is earlier than fixed versions and HTTP interface is enabled, system is vulnerable.Check Version:
clickhouse-client --query 'SELECT version()'Verify Fix Applied:
Verify ClickHouse version is one of: 22.9.1.2603, 22.8.2.11, 22.7.4.16, 22.6.6.16, or 22.3.12.19 or later.📡 Detection & Monitoring
Log Indicators:
- ClickHouse process crashes/restarts in system logs
- Unusual HTTP requests to port 8123 in access logs
Network Indicators:
- Malformed HTTP requests targeting port 8123
- Traffic patterns indicating buffer overflow attempts
SIEM Query:
source="clickhouse" AND (event="crash" OR event="restart") OR destination_port=8123 AND http_request contains abnormal patterns