CVE-2018-14668 : Security Advisory and Response

ClickHouse before version 1.1.54388 had a vulnerability in the "remote" table function that allowed arbitrary symbols in certain fields, leading to Cross Protocol Request Forgery Attacks.

Understanding CVE-2018-14668

In ClickHouse versions prior to 1.1.54388, a specific vulnerability existed that could be exploited for Cross Protocol Request Forgery Attacks.

What is CVE-2018-14668?

This CVE refers to a security flaw in ClickHouse versions before 1.1.54388 that enabled the inclusion of any symbols in the "user," "password," and "default_database" fields, making it susceptible to Cross Protocol Request Forgery Attacks.

The Impact of CVE-2018-14668

The vulnerability allowed malicious actors to manipulate certain fields in ClickHouse, potentially leading to unauthorized access and data breaches.

Technical Details of CVE-2018-14668

ClickHouse's vulnerability in the "remote" table function had the following technical aspects:

Vulnerability Description

The flaw in ClickHouse versions prior to 1.1.54388 permitted the inclusion of arbitrary symbols in critical fields, creating a security risk for Cross Protocol Request Forgery Attacks.

Affected Systems and Versions

Product: ClickHouse
Vendor: n/a
Versions Affected: All versions before 1.1.54388

Exploitation Mechanism

The vulnerability could be exploited by manipulating the "user," "password," and "default_database" fields, potentially leading to Cross Protocol Request Forgery Attacks.

Mitigation and Prevention

Taking immediate steps and implementing long-term security practices are crucial to mitigating the risks associated with CVE-2018-14668.

Immediate Steps to Take

Update ClickHouse to version 1.1.54388 or newer to patch the vulnerability.
Monitor for any suspicious activities or unauthorized access.

Long-Term Security Practices

Regularly update software and apply security patches promptly.
Conduct security audits and penetration testing to identify and address vulnerabilities.

Patching and Updates

Ensure that ClickHouse is kept up to date with the latest security patches to prevent exploitation of known vulnerabilities.