Command Injection in gosnowflake - CVE-2023-34231

Vulnerability details

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists via single sign-on (SSO) browser URL authentication. A remote unauthenticated attacker can set up a malicious, publicly accessible server which responds to the SSO URL with an attack payload, trick the victim into visiting the maliciously crafted connection URL and execute arbitrary code on the target system.

Affected software

How to mitigate CVE-2023-34231

External References

• https://github.com/snm/snowflakedb/gom/snowflakedb/goowflakedb/gosnowflake/security/advisories/GHSA-fwv2-65wh-2w8c
• https://github.com/snowflakedb/gosnowflake/commit/e11a2a555f1b9f7adc1f01fb7b5e7f38fbbb2a1c
• https://github.com/snowflakedb/gosnowflake/pull/757

Related Security Bulletins

• Multiple vulnerabilities in IBM Cloud Pak for Watson AIOps
• Multiple vulnerabilities in Dell ObjectScale