snowflakedb snowflake-hive-metastore-connector privileges management

Summaryinfo

A vulnerability was found in snowflakedb snowflake-hive-metastore-connector. It has been declared as critical. Impacted is an unknown function. Such manipulation leads to privileges management. This vulnerability is documented as CVE-2024-28851. The attack needs to be performed locally. There is not any exploit available. Applying a patch is advised to resolve this issue.

Detailsinfo

A vulnerability was found in snowflakedb snowflake-hive-metastore-connector (version now known). It has been rated as problematic. Affected by this issue is some unknown processing. The manipulation with an unknown input leads to a privileges management vulnerability. Using CWE to declare the problem leads to CWE-269. The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor. Impacted is confidentiality. CVE summarizes:

The Snowflake Hive metastore connector provides an easy way to query Hive-managed data via Snowflake. Snowflake Hive MetaStore Connector has addressed a potential elevation of privilege vulnerability in a `helper script` for the Hive MetaStore Connector. A malicious insider without admin privileges could, in theory, use the script to download content from a Microsoft domain to the local system and replace the valid content with malicious code. If the attacker then also had local access to the same system where the maliciously modified script is run, they could attempt to manipulate users into executing the attacker-controlled helper script, potentially gaining elevated privileges to the local system. The vulnerability in the script was patched on February 09, 2024, without a version bump to the Connector. User who use the helper script are strongly advised to use the latest version as soon as possible. Users unable to upgrade should avoid using the helper script.

The advisory is shared for download at github.com. This vulnerability is handled as CVE-2024-28851 since 03/11/2024. The exploitation is known to be difficult. The attack needs to be approached locally. The exploitation needs additional levels of successful authentication. Successful exploitation requires user interaction by the victim. There are neither technical details nor an exploit publicly available. The MITRE ATT&CK project declares the attack technique as T1068.

Applying the patch dfbf87dff456f6bb62c927711d97316f0c71d8ca is able to eliminate this problem. The bugfix is ready for download at github.com.

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Vendor

• snowflakedb

Name

• snowflake-hive-metastore-connector

License

• open-source

Website

• Product: https://github.com/snowflakedb/snowflake-hive-metastore-connector/

CPE 2.3info

• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion