CVE-2023-34231
📋 TL;DR
The gosnowflake Golang driver prior to version 1.6.19 contains a command injection vulnerability in SSO browser URL authentication. An attacker who tricks a user into visiting a maliciously crafted connection URL could achieve remote code execution on the user's machine. This affects all users of vulnerable gosnowflake driver versions.
💻 Affected Systems
- gosnowflake Golang driver
📦 What is this software?
Gosnowflake by Snowflake
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution on user's machine leading to full system compromise, data theft, and lateral movement.
Likely Case
Targeted phishing attacks against Snowflake users leading to credential theft or malware installation.
If Mitigated
Limited impact with proper URL whitelisting and user awareness training.
🎯 Exploit Status
Requires attacker to set up malicious server and trick user into clicking crafted URL.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.6.19
Vendor Advisory: https://github.com/snowflakedb/gosnowflake/security/advisories/GHSA-fwv2-65wh-2w8c
Restart Required: Yes
Instructions:
1. Update gosnowflake dependency to version 1.6.19 or later. 2. Rebuild and redeploy affected applications. 3. Restart services using the updated driver.
🔧 Temporary Workarounds
Disable SSO browser URL authentication
allTemporarily disable the vulnerable SSO authentication method until patching.
Modify application configuration to use alternative authentication methods
Implement URL validation
allAdd strict URL validation for SSO authentication endpoints.
Implement allowlist validation for SSO URLs in application code
🧯 If You Can't Patch
- Implement strict URL whitelisting for SSO authentication endpoints
- Deploy anti-phishing controls and user awareness training
🔍 How to Verify
Check if Vulnerable:
Check gosnowflake version in go.mod or go.sum files: grep 'gosnowflake' go.modCheck Version:
go list -m github.com/snowflakedb/gosnowflakeVerify Fix Applied:
Verify gosnowflake version is 1.6.19 or higher: go list -m github.com/snowflakedb/gosnowflake📡 Detection & Monitoring
Log Indicators:
- Unusual SSO authentication attempts
- Failed SSO URL validations
- Unexpected command execution
Network Indicators:
- Connections to unknown SSO servers
- Unusual outbound connections after SSO authentication
SIEM Query:
source="application_logs" AND ("gosnowflake" OR "SSO") AND ("error" OR "failed" OR "malformed")🔗 References
- https://github.com/snowflakedb/gosnowflake/commit/e11a2a555f1b9f7adc1f01fb7b5e7f38fbbb2a1c
- https://github.com/snowflakedb/gosnowflake/pull/757
- https://github.com/snowflakedb/gosnowflake/security/advisories/GHSA-fwv2-65wh-2w8c
- https://github.com/snowflakedb/gosnowflake/commit/e11a2a555f1b9f7adc1f01fb7b5e7f38fbbb2a1c
- https://github.com/snowflakedb/gosnowflake/pull/757
- https://github.com/snowflakedb/gosnowflake/security/advisories/GHSA-fwv2-65wh-2w8c
