CVE-2024-22412: 
ClickHouse vulnerability analysis and mitigation

ClickHouse is an open-source column-oriented database management system that contains a security vulnerability in its query caching mechanism. The vulnerability (CVE-2024-22412) affects the cloud ClickHouse offering prior to version 24.0.2.54535 and github.com/clickhouse/clickhouse version 23.1. The issue was discovered where query caching bypasses role-based access controls and the policies being enforced on roles (GitHub Advisory).

The vulnerability stems from the cache key only incorporating the username without considering the role name in the implementation. In affected versions, the query cache only respects separate users but does not properly handle role-based access controls. This occurs because the cache key is generated using only the AST and userName (QueryCache::Key key(ast, context->getUserName())), while ignoring the role information available in the context's EnabledRolesInfo. The issue has been assigned a CVSS v3.1 score of 2.4 (Low) with the vector string CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N (GitHub Advisory).

When query caching is enabled, users can bypass role-based access control lists (ACLs) by switching between different roles. Attackers who have control of a role could potentially guess queries and access data they shouldn't have access to, even when proper role-based policies are in place. This particularly affects scenarios where applications dynamically switch between various roles (GitHub Advisory).

The vulnerability can be exploited by an authenticated user with the ability to switch between roles. The attack requires the query cache to be enabled (use_query_cache=1) and involves switching between different roles that have different row-level security policies. The exploitation is relatively straightforward as it only requires normal query operations with role switching (GitHub Advisory).

The issue has been patched in ClickHouse version 24.1 and ClickHouse Cloud version 24.0.2.54535. For users unable to upgrade, the recommended workaround is to avoid using query cache when the application dynamically switches between various roles. Alternatively, users can employ multiple user accounts with distinct roles assigned to them instead of switching roles within a single user account (GitHub Advisory).