CVE-2023-30535: Snowflake JDBC Command Injection Vulnerability
Summary
CVE-2023-30535: Snowflake JDBC vulnerable to command injection via SSO URL authentication. Affects net.snowflake:snowflake-jdbc versions < 3.13.29. Fixed in 3.13.29. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The Snowflake JDBC driver is a component used for connecting Java applications to the Snowflake cloud data platform. It provides functionality for executing SQL queries and managing database connections. The driver is commonly used in Maven projects with the package name 'net.snowflake:snowflake-jdbc'. This specific version of the driver (prior to 3.13.29) is vulnerable to a command injection vulnerability when using SSO URL authentication.
Vulnerability Detail
The Snowflake JDBC driver version prior to 3.13.29 is susceptible to a command injection vulnerability through SSO URL authentication. An attacker can exploit this vulnerability by setting up a malicious server that responds to the SSO URL with a payload. If a user unknowingly visits a connection URL crafted by the attacker, their local machine can execute the malicious payload, leading to remote code execution. This vulnerability has a CVSS score of 7.3, indicating a high severity level.
How To Fix
Latest published version: 4.4.0 as of 23 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
3.13.29
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is crucial to update the Snowflake JDBC driver to the patched version to ensure the security of the application.
Conclusion
The Snowflake JDBC driver version prior to 3.13.29 is vulnerable to a command injection vulnerability. To ensure the security of your application, it is crucial to update the driver to the patched version. Failure to do so may result in remote code execution and potential compromise of the system. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for net.snowflake:snowflake-jdbc →
FAQ
The vulnerability allows an attacker to execute remote code on a user's machine by tricking them into visiting a maliciously crafted connection URL. This can lead to unauthorized access, data theft, or further exploitation of the compromised system.
You can use Vulert's playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities, using only the pom.xml file without requiring access to the code or installation.
There are no known instances of this vulnerability being exploited in the wild. However, it is crucial to apply the necessary patches to prevent any potential attacks.
No, updating the Snowflake JDBC driver to the patched version is the only recommended solution to mitigate the vulnerability. It is essential to prioritize the security of your application by keeping all dependencies up to date.
You can find more information about this vulnerability, including the patch details and technical specifics, in the GitHub advisory database: https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/04/GHSA-4g3j-c4wg-6j7x/GHSA-4g3j-c4wg-6j7x.json
Related vulnerabilities
Recent vulnerabilities recorded for net.snowflake:snowflake-jdbc.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
