Snowflake JDBC vulnerable to command injection via SSO URL authentication

CVE-2023-30535

What is CVE-2023-30535?

The Snowflake JDBC driver is vulnerable to a command injection attack due to improper handling of user input in the connection URL. This flaw allows an attacker to host a malicious server that responds with crafted payloads. If a user unknowingly accesses this compromised connection URL, their local system could execute harmful commands, resulting in potential remote code execution. It is critical for users to update their Snowflake JDBC driver to version 3.13.29 or later to mitigate this risk.

References