PT-2025-12212 · Snowflake+3 · Snowflake+3

Publicado 2025-03-20 · Atualizado 2025-03-20 · CVE-2024-8055

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Vanna version 0.6.3

Description The issue allows unauthenticated remote users to read arbitrary local files on the victim server by exploiting exposed SQL queries through a Python Flask API. This is achieved via SQL injection in the Snowflake database, specifically in file staging operations using the PUT and COPY commands.

Recommendations For Vanna version 0.6.3, consider restricting access to the Snowflake database and limiting the use of the PUT and COPY commands until a patch is available. As a temporary workaround, review and modify the Python Flask API to prevent SQL injection attacks.

Correção

SQL injection

Information Disclosure

Enumeração de Fraquezas

CWE-89

CWE-200

Identificadores relacionados

CVE-2024-8055

Produtos afetados

Python

Python Flask Api

Snowflake

Vanna

Referências · 3

• https://nvd.nist.gov/vuln/detail/CVE-2024-8055 · Nota de Segurança
• https://huntr.com/bounties/7c92a611-6756-4885-8969-01d8b85b6c63 · Nota
• https://twitter.com/CVEnew/status/1902671132546990541 · Publicação no Twitter