Cyber Resilience

CVE-2024-23689

HighPublic PoC

Published: 19 January 2024

Published
19 January 2024
Modified
29 November 2025
KEV Added
—
Patch
—
CVSS Score v3.1 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0126 79.8th percentile
Risk Priority 18 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2024-23689 is a high-severity Generation of Error Message Containing Sensitive Information (CWE-209) vulnerability in Clickhouse Java Libraries. Its CVSS base score is 8.8 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Credentials In Files (T1552.001); ranked in the top 20.2% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

EU & UK References

Vulnerability details

Exposure of sensitive information in exceptions in ClichHouse's clickhouse-r2dbc, com.clickhouse:clickhouse-jdbc, and com.clickhouse:clickhouse-client versions less than 0.4.6 allows unauthorized users to gain access to client certificate passwords via client exception logs. This occurs when 'sslkey' is specified and an exception, such…

more

as a ClickHouseException or SQLException, is thrown during database operations; the certificate password is then included in the logged exception message.

CWE(s)
CWE-209

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1552.001 Credentials In Files Credential Access
Adversaries may search local file systems and remote file shares for files containing insecurely stored credentials.
attack.mitre.org →
T1552.004 Private Keys Credential Access
Adversaries may search for private key certificate files on compromised systems for insecurely stored credentials.
attack.mitre.org →
T1654 Log Enumeration Discovery
Adversaries may enumerate system and service logs to find useful data.
attack.mitre.org →
Why these techniques?

Vulnerability exposes client certificate private key passwords in client exception logs, enabling adversaries to access unsecured credentials in files (logs), private key passwords, and enumerate logs for sensitive information.

Affected Assets

clickhouse
java libraries
≤ 0.4.6

Mitigating Controls

Likely Mitigating Controls AI

Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.

AU-13 Monitoring for Information Disclosure
addresses: CWE-209

Detects error messages that leak sensitive information as evidence of disclosure.

IA-6 Authentication Feedback
addresses: CWE-209

The control directly mitigates generation of error messages containing sensitive authentication details by requiring obscured feedback instead of verbose responses.

SC-30 Concealment and Misdirection
addresses: CWE-209

Misdirection allows generation of misleading error messages that withhold or falsify sensitive details.

SI-11 Error Handling
addresses: CWE-209

Explicitly requires error messages to avoid including sensitive or exploitable details while still supporting corrective action.

SI-15 Information Output Filtering
addresses: CWE-209

Validation ensures error messages contain only expected, non-sensitive content and blocks leakage via verbose errors.

SI-17 Fail-safe Procedures
addresses: CWE-209

Fail-safe procedures can be defined to suppress or sanitize error output, reducing generation of messages that contain sensitive information.

References