PT-2025-12212 · Snowflake+3 · Snowflake+3

Published 2025-03-20 · Updated 2025-03-20 · CVE-2024-8055

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Vanna version 0.6.3

Description The issue allows unauthenticated remote users to read arbitrary local files on the victim server by exploiting exposed SQL queries through a Python Flask API. This is achieved via SQL injection in the Snowflake database, specifically in file staging operations using the PUT and COPY commands.

Recommendations For Vanna version 0.6.3, consider restricting access to the Snowflake database and limiting the use of the PUT and COPY commands until a patch is available. As a temporary workaround, review and modify the Python Flask API to prevent SQL injection attacks.

Fix

SQL injection

Information Disclosure

Weakness Enumeration

CWE-89

CWE-200

Related Identifiers

CVE-2024-8055

Affected Products

Python

Python Flask Api

Snowflake

Vanna

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2024-8055 · Security Note
• https://huntr.com/bounties/7c92a611-6756-4885-8969-01d8b85b6c63 · Note
• https://twitter.com/CVEnew/status/1902671132546990541 · Twitter Post