Executive brief
The Snowflake NodeJS Driver is a library that allows applications to connect to Snowflake data warehouse services. A command injection vulnerability in its SSO (Single Sign-On) browser authentication flow allows attackers to execute arbitrary code on users' machines by tricking them into visiting a malicious URL. An attacker could compromise sensitive data or take control of the system running the driver.
Technical details
The vulnerability is a command injection flaw (CWE-77) in the Snowflake NodeJS Driver's SSO browser URL authentication mechanism. An attacker can inject malicious commands by setting up a malicious server and redirecting users to a crafted connection URL; when the user visits the URL, the driver renders and executes the attacker's payload on the local machine, resulting in remote code execution. User interaction is required (the user must visit the malicious URL), but the attack vector is network-based and requires low privileges. The vulnerability was patched in version 1.6.21, merged on April 18, 2023; all versions before 1.6.21 are affected.
Affected products
- Snowflake NodeJS Driver before 1.6.21
Timeline
- 2023-06-09: disclosed
- 2023-04-18: patched: Fix merged into version 1.6.21