CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
REQUIRED
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
EPSS
Percentile
76.3%
github.com/snowflakedb/gosnowflake is vulnerable to Command Injection. The vulnerability exists due to the Snowflake Golang driver via SSO browser URL authentication because it lacks database URL sanitization. To exploit this, an attacker would need to establish a malicious database resource and trick users into connecting to it. Once the connection is established, the payload would execute, resulting in remote code execution.
community.snowflake.com/s/article/Go-Snowflake-Driver-Release-Notes
github.com/advisories/GHSA-fwv2-65wh-2w8c
github.com/snowflakedb/gosnowflake/commit/e11a2a555f1b9f7adc1f01fb7b5e7f38fbbb2a1c
github.com/snowflakedb/gosnowflake/pull/757
github.com/snowflakedb/gosnowflake/security/advisories/GHSA-fwv2-65wh-2w8c