CVE-2024-23689
📋 TL;DR
This vulnerability exposes client certificate passwords in exception logs when SSL authentication fails in ClickHouse Java clients. Attackers who can access application logs can steal sensitive credentials. Affects organizations using ClickHouse Java clients with SSL client certificate authentication.
💻 Affected Systems
- clickhouse-r2dbc
- com.clickhouse:clickhouse-jdbc
- com.clickhouse:clickhouse-client
📦 What is this software?
Java Libraries by Clickhouse
⚠️ Risk & Real-World Impact
Worst Case
Attackers gain client certificate passwords, impersonate legitimate users, access sensitive database data, and potentially pivot to other systems using stolen credentials.
Likely Case
Unauthorized access to database contents, data exfiltration, and credential theft from accessible application logs.
If Mitigated
Limited impact if logs are properly secured with restricted access and monitoring, though credentials remain exposed in log storage.
🎯 Exploit Status
Exploitation requires access to application logs where exceptions are recorded. No authentication needed once log access is obtained.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 0.4.6
Vendor Advisory: https://github.com/ClickHouse/clickhouse-java/security/advisories/GHSA-g8ph-74m6-8m7r
Restart Required: Yes
Instructions:
1. Update all ClickHouse Java client dependencies to version 0.4.6 or higher. 2. Update pom.xml or build.gradle to use fixed versions. 3. Rebuild and redeploy applications. 4. Restart any running services using affected clients.
🔧 Temporary Workarounds
Disable detailed exception logging
allConfigure logging frameworks to exclude sensitive exception details from logs
Configure logback.xml or log4j2.xml to filter out ClickHouseException/SQLException messages
Set logging level to ERROR or higher for affected packages
Restrict log access
linuxImplement strict access controls and encryption for application logs
chmod 600 /var/log/application/*
Implement log encryption at rest
Use centralized logging with RBAC
🧯 If You Can't Patch
- Disable SSL client certificate authentication and use alternative authentication methods
- Implement real-time log monitoring and alerting for credential exposure patterns
🔍 How to Verify
Check if Vulnerable:
Check dependency versions in pom.xml, build.gradle, or manifest files for clickhouse-java components below 0.4.6Check Version:
mvn dependency:tree | grep clickhouse OR gradle dependencies | grep clickhouseVerify Fix Applied:
Verify all clickhouse-java dependencies are at version 0.4.6 or higher and test SSL authentication with intentional failures to confirm passwords are not logged📡 Detection & Monitoring
Log Indicators:
- Exception messages containing 'sslkey' or certificate password strings
- ClickHouseException or SQLException logs with password-like patterns
Network Indicators:
- Unusual database access patterns following log access events
SIEM Query:
source="application.log" AND ("ClickHouseException" OR "SQLException") AND ("sslkey" OR "password=" OR regex(password_pattern))🔗 References
- https://github.com/ClickHouse/clickhouse-java/issues/1331
- https://github.com/ClickHouse/clickhouse-java/pull/1334
- https://github.com/ClickHouse/clickhouse-java/releases/tag/v0.4.6
- https://github.com/ClickHouse/clickhouse-java/security/advisories/GHSA-g8ph-74m6-8m7r
- https://github.com/advisories/GHSA-g8ph-74m6-8m7r
- https://vulncheck.com/advisories/vc-advisory-GHSA-g8ph-74m6-8m7r
- https://github.com/ClickHouse/clickhouse-java/issues/1331
- https://github.com/ClickHouse/clickhouse-java/pull/1334
- https://github.com/ClickHouse/clickhouse-java/releases/tag/v0.4.6
- https://github.com/ClickHouse/clickhouse-java/security/advisories/GHSA-g8ph-74m6-8m7r
- https://github.com/advisories/GHSA-g8ph-74m6-8m7r
- https://vulncheck.com/advisories/vc-advisory-GHSA-g8ph-74m6-8m7r
