Executive brief
The Snowflake NodeJS Driver for database connectivity includes an Easy Logging feature that reads configuration from a file on Linux and macOS systems. A race condition in the permission-checking logic allows a local attacker to modify the logging configuration file between permission checks, potentially redirecting logs to attacker-controlled locations or changing log verbosity levels to expose sensitive information.
Technical details
The vulnerability is a Time-of-Check Time-of-Use (TOCTOU) race condition (CWE-367) in the Easy Logging feature on Linux and macOS. When the driver reads a user-provided logging configuration file, it verifies that only the file owner can write to it; however, this check fails to confirm the file owner matches the user running the driver, and the window between permission verification and actual file use allows an attacker to swap the file. An attacker with local access and write permissions to the configuration file or its directory can exploit this to gain control over logging behavior. The vulnerability affects versions 1.10.0 through 2.0.3; Snowflake patched it in version 2.0.4.
Affected products
- Snowflake NodeJS Driver 1.10.0 through 2.0.3
Timeline
- 2025-04-28: disclosed: Vulnerability disclosed via GHSA-wmjq-jrm2-9wfr
- 2025-04-28: patched: Patch released in version 2.0.4