CVE-2025-1386
📋 TL;DR
This vulnerability in the ch-go library allows an attacker to inject malicious query packets into ClickHouse connections when processing large uncompressed external data. Systems using vulnerable versions of ch-go for ClickHouse client connections are affected, particularly those accepting untrusted external data sources.
💻 Affected Systems
- ClickHouse ch-go library
📦 What is this software?
Ch by Clickhouse
⚠️ Risk & Real-World Impact
Worst Case
Attackers could execute arbitrary queries against ClickHouse databases, potentially leading to data exfiltration, data corruption, or denial of service.
Likely Case
Query injection allowing unauthorized data access or manipulation, though limited by existing database permissions.
If Mitigated
Minimal impact if proper input validation and query sanitization are already implemented.
🎯 Exploit Status
Requires attacker to control external data being processed and knowledge of target query structure.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: ch-go v0.61.0 and later
Vendor Advisory: https://github.com/ClickHouse/ch-go/security/advisories/GHSA-m454-3xv7-qj85
Restart Required: No
Instructions:
1. Update ch-go dependency to v0.61.0 or later. 2. Rebuild and redeploy applications using ch-go. 3. Test functionality with updated library.
🔧 Temporary Workarounds
Input Validation and Sanitization
allImplement strict validation and sanitization of external data before processing through ch-go.
Compression Enforcement
allRequire compression for all external data inputs to prevent the specific condition.
🧯 If You Can't Patch
- Implement network segmentation to isolate ClickHouse servers from untrusted data sources.
- Deploy WAF or application firewall rules to detect and block suspicious query patterns.
🔍 How to Verify
Check if Vulnerable:
Check ch-go version in your project dependencies or go.mod file for versions before 0.61.0.Check Version:
go list -m github.com/ClickHouse/ch-goVerify Fix Applied:
Confirm ch-go version is 0.61.0 or later and test with known malicious data patterns.📡 Detection & Monitoring
Log Indicators:
- Unusual query patterns in ClickHouse logs
- Multiple query attempts from single external data source
- Query syntax errors following external data processing
Network Indicators:
- Unusually large uncompressed data transfers to ClickHouse endpoints
- Multiple query packets in single connection
SIEM Query:
source="clickhouse" AND ("query injection" OR "malformed query" OR "unexpected packet")