2023-3-17 Snowflake JDBC Security Advisory

### Synopsis: Snowflake JDBC driver addresses a command injection vulnerability via SSO URL authentication. The vulnerability was patched on March 17, 2023 as part of Snowflake JDBC driver Version 3.13.29. ## 1. Impacted Products Snowflake JDBC driver versions before Version 3.13.29. ## 2. Introduction On March 17th, 2023, Snowflake merged a patch that fixed a command injection vulnerability in the Snowflake JDBC driver via SSO URL authentication. The vulnerability affected the Snowflake JDBC driver before Version 3.13.29. All users should immediately upgrade the Snowflake JDBC driver to the latest version: 3.13.29. ## 3. Command Injection Vulnerability ### 3.1 Description Snowflake was informed by Peter Mularien of Nightcrawler Security, LLC via our bug bounty program of a command injection vulnerability in the Snowflake JDBC driver via SSO URL authentication. Snowflake has evaluated the severity of the issue and determined it was in the high range with a maximum CVSSv3 base score of 7.3. ### 3.2 Scenarios and attack vector(s) Users of the Snowflake JDBC driver were vulnerable to a command injection vulnerability. An attacker could set up a malicious, publicly accessible server which responds to the SSO URL with an attack payload. If the attacker then tricked a user into visiting the maliciously crafted connection URL, the user’s local machine would render the malicious payload, leading to a remote code execution. ### 3.3 Our response On August 2nd, 2022, Peter Mularien of Nightcrawler Security, LLC reported the issue to Snowflake via our bug bounty program. On March 17th, 2023, Snowflake released a patch in Snowflake JDBC driver Version 3.13.29. The patch ensures that SSO URLs are valid and match an expected pattern. ### 3.4 Resolution We strongly recommend users upgrade to Version 3.13.29 as soon as possible. ## 4. Contact Please contact security@snowflake.com if you have any questions regarding this advisory. If you discover a security vulnerability in one of our products or websites, please report the issue to HackerOne. For more information, please see our Vulnerability Disclosure Policy.

CVSS 3.1

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N

Severity from

GitHub (reviewed advisory)

• github.com/snowflakedb/snowflake-jdbc/security/advisories/GHSA-4g3j-c4wg-6j7x
• github.com/snowflakedb/snowflake-jdbc