CVE-2018-14669 in ClickHouse MySQL Client
Summary
by MITRE
ClickHouse MySQL client before versions 1.1.54390 had "LOAD DATA LOCAL INFILE" functionality enabled that allowed a malicious MySQL database read arbitrary files from the connected ClickHouse server.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 06/25/2025
The vulnerability CVE-2018-14669 represents a critical security flaw in ClickHouse MySQL client implementations prior to version 1.1.54390. This issue stems from the inadvertent enabling of the "LOAD DATA LOCAL INFILE" functionality within the MySQL compatibility layer of ClickHouse. The vulnerability operates at the protocol level where MySQL client applications can execute commands that instruct the server to load data from local files on the system. When this functionality remains enabled in the ClickHouse server, it creates an attack vector that allows malicious actors to leverage MySQL client connections to access arbitrary files on the ClickHouse server filesystem. The flaw exists specifically in the MySQL client implementation rather than the core ClickHouse database engine itself, making it a compatibility layer issue that affects interoperability with MySQL tools and applications.
The technical exploitation of this vulnerability occurs through the MySQL protocol's LOAD DATA LOCAL INFILE command, which is designed to allow MySQL clients to load local files directly into database tables. In the affected ClickHouse versions, this functionality was enabled by default, allowing attackers to specify local file paths that would be read by the server during the data loading process. This creates a privilege escalation scenario where a MySQL client connection can be used to read sensitive files such as configuration files, system credentials, or database backups that should normally be protected from unauthorized access. The vulnerability is particularly dangerous because it operates at the network level, allowing remote attackers to exploit the functionality without requiring direct system access, and can be triggered through standard MySQL client tools that support this feature.
The operational impact of CVE-2018-14669 extends beyond simple data exfiltration to potentially compromise entire server environments. Attackers can use this vulnerability to access critical system information including database connection strings, user credentials, and configuration parameters that may reveal network topology or system architecture details. The vulnerability affects organizations that use ClickHouse in environments where MySQL client tools are deployed, particularly those using applications that rely on the LOAD DATA LOCAL INFILE functionality for data import operations. This could include data migration tools, ETL processes, or any application that connects to ClickHouse through MySQL protocol compatibility layer. The risk is amplified when ClickHouse servers are deployed in cloud environments or multi-tenant architectures where unauthorized file access could lead to data breaches across multiple tenants or applications.
Organizations should immediately upgrade to ClickHouse version 1.1.54390 or later to remediate this vulnerability, as this release disables the problematic "LOAD DATA LOCAL INFILE" functionality by default. System administrators should also review their MySQL client configurations to ensure that local file access permissions are properly restricted, particularly when connecting to ClickHouse servers. Network segmentation and firewall rules should be implemented to limit access to ClickHouse servers from untrusted networks, and monitoring should be enabled to detect unusual file access patterns or connection attempts that may indicate exploitation attempts. Additionally, organizations should audit their existing MySQL client applications to identify any that may be relying on this functionality and plan migration strategies accordingly. This vulnerability aligns with CWE-22 (Improper Limitation of a Pathname to a Restricted Directory) and CWE-73 (External Control of File Name or Path) categories, and represents a technique that could be mapped to ATT&CK tactic TA0006 (Credential Access) through the ability to extract sensitive information from the compromised system.