CVE-2023-34230— Snowflake Connector vulnerable to Command Injection
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2023-34230
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Snowflake Connector vulnerable to Command Injection
Source: NVD (National Vulnerability Database)
Vulnerability Description
snowflake-connector-net, the Snowflake Connector for .NET, is vulnerable to command injection prior to version 2.0.18 via SSO URL authentication. In order to exploit the potential for command injection, an attacker would need to be successful in (1) establishing a malicious resource and (2) redirecting users to utilize the resource. The attacker could set up a malicious, publicly accessible server which responds to the SSO URL with an attack payload. If the attacker then tricked a user into visiting the maliciously crafted connection URL, the user’s local machine would render the malicious payload, leading to a remote code execution. This attack scenario can be mitigated through URL whitelisting as well as common anti-phishing resources. Version 2.0.18 fixes this issue.
Source: NVD (National Vulnerability Database)
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N
Source: NVD (National Vulnerability Database)
Vulnerability Type
在命令中使用的特殊元素转义处理不恰当(命令注入)
Source: NVD (National Vulnerability Database)
Vulnerability Title
Snowflake snowflake-connector-net 命令注入漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Snowflake snowflake-connector-net是美国Snowflake公司的适用于 .NET 的 Snowflake 连接器。 snowflake-connector-net 2.0.18之前版本存在命令注入漏洞，该漏洞源于容易通过SSO URL身份验证进行命令注入，攻击者利用该漏洞可以导致远程代码执行。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| snowflakedb | snowflake-connector-net | < 2.0.18 | - |
II. Public POCs for CVE-2023-34230
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2023-34230
Please Login to view more intelligence information
Same Patch Batch · snowflakedb · 2023-06-08 · 4 CVEs total
| CVE-2023-34232 | 7.3 HIGH | Snowflake NodeJS Driver vulnerable to Command Injection |
| CVE-2023-34233 | Snowflake Python Connector vulnerable to Command Injection | |
| CVE-2023-34231 | Snowflake Golang Driver vulnerable to Command Injection |
IV. Related Vulnerabilities
Same vendor: snowflakedb
- CVE-2026-3293
snowflakedb snowflake-jdbc JDBC URL SdkProxyRoutePlanner.jav - CVE-2025-46329
Snowflake Connector for C/C++ inserts client-side encryption - CVE-2025-46330
Snowflake Connector for C/C++ retries malformed requests - CVE-2025-46328
NodeJS Driver for Snowflake has race condition when checking - CVE-2025-46327
Go Snowflake Driver has race condition when checking access
Same weakness: CWE-77
- CVE-2026-42453
Termix: Command injection in extractArchive/compressFiles vi - CVE-2026-42271
LiteLLM: Authenticated command execution via MCP stdio test - CVE-2026-41500
electerm has Command Injection Vulnerability via runMac func - CVE-2026-41501
electerm has Command Injection Vulnerability via runLinux fu - CVE-2026-35428
Azure Cloud Shell Spoofing Vulnerability
V. Comments for CVE-2023-34230
No comments yet