# Wiz Research Uncovers Exposed DeepSeek Database Leaking Sensitive Information, Including Chat History

Unauthenticated ClickHouse database on DeepSeek subdomains exposed over 1M log entries including chat history, API keys, and backend secrets.

- Payout: Research
- Severity: critical
- Program: DeepSeek
- Write-up by: Wiz Research
- Disclosed: 2025-01-29
- Write-up quality: 6/10
- Original: https://www.wiz.io/blog/wiz-research-uncovers-exposed-deepseek-database-leak
- Library page: https://bugbountylibrary.com/r/blog%3Awiz-io-blog-wiz-research-uncovers-exposed-deepseek-database-leak
- Tags: area:ai domain:ai domain:cloud impact:data-leak impact:pii-leak kind:research platform:threat-intel sev:critical technique:recon vuln:info-disclosure vuln:misconfiguration vuln:secrets-leak

**Target:** ClickHouse database HTTP interface on ports 8123/9000
**Root cause:** ClickHouse database was exposed to the internet on non-standard ports with no authentication configured, allowing anyone to run arbitrary SQL.
**Steps:**
1. Enumerate subdomains of deepseek.com (passive + active recon), ~30 hosts found.
2. Scan beyond ports 80/443; find open 8123 and 9000 on oauth2callback.deepseek.com and dev.deepseek.com.
3. Access ClickHouse HTTP interface at `/play` path in browser.
4. Run `SHOW TABLES;` to list datasets; identify `log_stream` table.
5. Query `log_stream` columns (timestamp, span_name, string.values, _service, _source) to read plaintext chat history, API keys, backend details.
6. Potential `SELECT * FROM file('filename')` to read local files depending on config (not executed).
**How found:** Team mapped DeepSeek's external attack surface via subdomain recon, then expanded port scanning beyond 80/443, spotting unusual open ports 8123/9000 which turned out to be ClickHouse.
**Exploitation:** No attack observed; researcher accessed the open HTTP interface, enumerated tables via SHOW TABLES, and read the log_stream table containing plaintext chat logs and secrets. Full DB control and potential privilege escalation were possible but not exercised.
**Escalation:** Potential privilege escalation within DeepSeek environment and local file read via ClickHouse file() function, not demonstrated.
**Insight:** When doing recon on AI startups, scan non-standard ports (8123/9000 for ClickHouse, 9200 Elasticsearch, 6379 Redis) on every subdomain — internal analytics DBs often get exposed unauthenticated on odd ports that standard HTTP recon misses.

## Proof of concept (copied exactly from the original report)

**Unauthenticated ClickHouse HTTP interface on exposed ports**

```
http://oauth2callback.deepseek.com:8123  

- http://dev.deepseek.com:8123  

- http://oauth2callback.deepseek.com:9000  

- http://dev.deepseek.com:9000
```

**SHOW TABLES query via /play path**

```
By leveraging ClickHouse’s HTTP interface, we accessed the /play path, which allowed direct execution of arbitrary SQL queries via the browser. Running a simple SHOW TABLES; query returned a full list of accessible datasets.
```

**File exfiltration query example**

```
SELECT * FROM file('filename') depending on their ClickHouse configuration.
```