Failure to Sanitize Special Elements into a Different Plane (Special Element Injection) vulnerability in Apache Airflow Providers Snowflake. This issue affects Apache Airflow Providers Snowflake: before 6.4.0. Sanitation of table and stage parameters were added in CopyFromExternalStageToSnowflakeOperator to prevent SQL injection Users are recommended to upgrade to version 6.4.0, which fixes the issue.
The vulnerability results from inadequate sanitization of the 'table' and 'stage' parameters passed to the CopyFromExternalStageToSnowflakeOperator. These parameters were not filtered for special SQL syntax elements, which enabled injection of arbitrary SQL commands into queries executed in the Snowflake database. Classified as CWE-75 (Failure to Sanitize Special Elements into a Different Plane), the vulnerability allows manipulation of query logic through crafted input data.
An attacker can gain unauthorized access to data, modify or delete Snowflake database contents, and depending on account permissions — potentially take control of system resources (complete breach of confidentiality, integrity, and availability).
The Apache Airflow Providers Snowflake package should be updated immediately to version 6.4.0 or later, which includes mechanisms for sanitizing the 'table' and 'stage' parameters in the CopyFromExternalStageToSnowflakeOperator.
Apache Airflow Providers Snowflake in all versions before 6.4.0
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HApache Airflow Providers Snowflake
APPApache< 6.4.0
Related vulnerabilities
Apache Tomcat: Path Equivalence prowadzący do RCE i ujawnienia danych
Apache OFBiz — nieautoryzowane wykonanie kodu przez błędną autoryzację
Apache HTTP Server mod_rewrite — ujawnienie kodu i RCE poprzez błędne escapowanie
Path Traversal w Apache OFBiz umożliwiający zdalne wykonanie kodu
RCE w Apache HugeGraph-Server — zdalne wykonanie poleceń bez uwierzytelnienia