Snowflake Python Connector vulnerable to Command Injection

CVE-2023-34233

What is CVE-2023-34233?

The Snowflake Connector for Python, used to connect Python applications to Snowflake, is susceptible to command injection through single sign-on (SSO) browser URL authentication in versions prior to 3.0.2. An attacker can exploit this vulnerability by creating a malicious publicly accessible server that responds to a SSO URL with a harmful payload. If a user visits this crafted URL, it can lead to remote code execution on the user's local machine. Implementing URL whitelisting and leveraging anti-phishing resources are effective measures to mitigate this threat. Version 3.0.2 addresses this vulnerability with a patch.

References