AVID-2026-R1247

Description

Snowflake Python Connector vulnerable to Command Injection (CVE-2023-34233)

Details

The Snowflake Connector for Python provides an interface for developing Python applications that can connect to Snowflake and perform all standard operations. Versions prior to 3.0.2 are vulnerable to command injection via single sign-on(SSO) browser URL authentication. In order to exploit the potential for command injection, an attacker would need to be successful in (1) establishing a malicious resource and (2) redirecting users to utilize the resource. The attacker could set up a malicious, publicly accessible server which responds to the SSO URL with an attack payload. If the attacker then tricked a user into visiting the maliciously crafted connection URL, the user’s local machine would render the malicious payload, leading to a remote code execution. This attack scenario can be mitigated through URL whitelisting as well as common anti-phishing resources. Version 3.0.2 contains a patch for this issue.

Reason for inclusion in AVID: The CVE describes a command injection vulnerability in the Snowflake Python Connector (snowflake-connector-python) prior to 3.0.2. This library is widely used in AI/data pipelines to connect AI workloads to Snowflake. It represents a software supply-chain vulnerability in a dependency that could be part of general-purpose AI systems, affecting deployment and runtime. The vulnerability enables remote code execution via a manipulated SSO URL, meeting security/safety vulnerability criteria. The report provides affected versions, remediation (upgrade to 3.0.2), and references, giving sufficient signals for AVID curation.

References

Affected or Relevant Artifacts

Developer: snowflakedb
Deployer: snowflakedb
Artifact Details:

Type	Name
System	snowflake-connector-python

Impact

AVID Taxonomy Categorization

Risk domains: Security
SEP subcategories: S0100: Software Vulnerability
Lifecycle stages: L06: Deployment

CVSS

Version	3.0
Vector String	CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N
Base Score	7.3
Base Severity	🔴 High
Attack Vector	NETWORK
Attack Complexity	🟢 Low
Privileges Required	🟢 Low
User Interaction	REQUIRED
Scope	UNCHANGED
Confidentiality Impact	🔴 High
Integrity Impact	🔴 High
Availability Impact	NONE

CWE

ID	Description
CWE-77	CWE-77: Improper Neutralization of Special Elements used in a Command (‘Command Injection’)

Other information

Report Type: Advisory
Credits:
Date Reported: 2023-06-08
Version: 0.3.3
AVID Entry