Experts at Wiz Research have identified a publicly exposed ClickHouse database belonging to DeepSeek, a Chinese AI startup renowned for its innovative models.
The vulnerability granted full control over database operations, exposing sensitive information such as chat history, secret keys, backend details, and over a million lines of log streams.
The issue was responsibly disclosed to DeepSeek, and the company has since secured the database.
DeepSeek has been under the spotlight recently due to its cutting-edge AI models, particularly the DeepSeek-R1 reasoning model.
The model has been touted as a major rival to systems like OpenAI’s o1, excelling in performance, cost-effectiveness, and efficiency.
As the company’s stature grew, the Wiz Research team prioritized examining its external security posture to identify vulnerabilities—ultimately discovering this serious lapse.
During their investigation, Wiz Research found the ClickHouse database hosted at two accessible endpoints:
Despite its immense importance, the database was completely open, requiring no authentication whatsoever.
The exposed ClickHouse environment allowed not only unrestricted access but also the potential for privilege escalation across DeepSeek’s internal systems.
The exposed database included a massive treasure trove of sensitive data, with a critical table named log_stream standing out. This table alone contained over one million log entries with revealing data, including:
The exposure posed not only a risk to DeepSeek’s infrastructure but also to the privacy and security of its end-users.
ClickHouse, a popular open-source database used for real-time data processing and analytics, is powerful yet vulnerable to misconfigurations.
The /play path within ClickHouse’s HTTP interface allowed arbitrary SQL queries to be executed directly via a browser. With a query as simple as SHOW TABLES, the Wiz team gained access to the database structure.
Queries could even exfiltrate sensitive files depending on ClickHouse’s configuration.
This breach is a stark reminder for organizations leveraging powerful tools like ClickHouse. Misconfigurations can leave critical infrastructure exposed, opening doors for attackers.
The need for robust security mechanisms, such as authentication, role-based access control, and regular audits, cannot be overstated.
Upon being informed by Wiz Research, DeepSeek acted swiftly to secure the exposed database. While the immediate threat has been mitigated, this incident highlights the ever-present risks inherent in managing large-scale AI systems and data.
The DeepSeek database exposure underlines a critical call to action for companies worldwide: as systems become more powerful and interconnected, robust security must be the foundation of every operation.
Collect Threat Intelligence with TI Lookup to improve your company’s security - Get 50 Free Request
A groundbreaking technique for Kerberos relaying over HTTP, leveraging multicast poisoning, has been recently detailed…
Since mid-2024, cybersecurity researchers have been monitoring a sophisticated Android malware campaign dubbed "Tria Stealer,"…
Proton, the globally recognized provider of privacy-focused services such as Proton VPN and Proton Pass,…
The cybersecurity landscape faces increasing challenges as Arcus Media ransomware emerges as a highly sophisticated…
Proofpoint researchers have identified a marked increase in phishing campaigns and malicious domain registrations designed…
A recent investigation by Unit 42 of Palo Alto Networks has uncovered a sophisticated, state-sponsored…