snowflake-connector-net up to 2.0.17 SSO command injection

Summaryinfo

A vulnerability was found in snowflake-connector-net up to 2.0.17. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the component SSO. The manipulation results in command injection. This vulnerability is reported as CVE-2023-34230. The attack can be launched remotely. No exploit exists. It is recommended to upgrade the affected component.

Detailsinfo

A vulnerability, which was classified as critical, was found in snowflake-connector-net up to 2.0.17. Affected is some unknown processing of the component SSO. The manipulation with an unknown input leads to a command injection vulnerability. CWE is classifying the issue as CWE-77. The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component. This is going to have an impact on confidentiality, integrity, and availability. CVE summarizes:

snowflake-connector-net, the Snowflake Connector for .NET, is vulnerable to command injection prior to version 2.0.18 via SSO URL authentication. In order to exploit the potential for command injection, an attacker would need to be successful in (1) establishing a malicious resource and (2) redirecting users to utilize the resource. The attacker could set up a malicious, publicly accessible server which responds to the SSO URL with an attack payload. If the attacker then tricked a user into visiting the maliciously crafted connection URL, the user’s local machine would render the malicious payload, leading to a remote code execution. This attack scenario can be mitigated through URL whitelisting as well as common anti-phishing resources. Version 2.0.18 fixes this issue.

The weakness was disclosed 06/09/2023 as GHSA-223g-8w3x-98wr. The advisory is shared for download at github.com. This vulnerability is traded as CVE-2023-34230 since 05/31/2023. There are neither technical details nor an exploit publicly available. The MITRE ATT&CK project declares the attack technique as T1202.

Upgrading to version 2.0.18 eliminates this vulnerability.

Once again VulDB remains the best source for vulnerability data.

Productinfo

Name

• snowflake-connector-net

Version

• 2.0.0
• 2.0.1
• 2.0.2
• 2.0.3
• 2.0.4
• 2.0.5
• 2.0.6
• 2.0.7
• 2.0.8
• 2.0.9
• 2.0.10
• 2.0.11
• 2.0.12
• 2.0.13
• 2.0.14
• 2.0.15
• 2.0.16
• 2.0.17

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion