Cloudanix VulnDB

CVE-2025-24791

Medium · 4.4

snowflake-sdk may incorrectly validate temporary credential cache file permissions

CVSS

4.4

EPSS

0.1%

Published

Jan 29, 2025

CISA due date

—

Cloudanix analysis

Monitor only SSVC: Track

A bug in the Snowflake database driver for Node.js on Linux lets someone who can write files in a certain folder steal temporary login credentials and access the database.

Exploitation
Local Privilege
Attacker needs
Local User
Complexity
Moderate
Impact
Data Exposure
Component
Library
Class
Authorization Bypass
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

The NodeJS Driver's permission verification for the temporary credential cache file on Linux always succeeds without correctly checking ownership or mode bits, allowing any writable file in the cache directory to be used for storing cached credentials obtained via EXTERNALBROWSER or USERNAME_PASSWORD_MFA.

Why it matters to the business

Attackers who can write to the local cache directory may obtain cached Snowflake credentials, leading to unauthorized database access and potential data exposure without requiring direct authentication.

How an attack unfolds

An attacker with write access to the user's local credential cache directory creates an empty file in that location; when the driver next attempts to cache credentials after EXTERNALBROWSER or MFA login, it accepts the planted file and writes the temporary tokens into it, which the attacker can then read.

How to fix it

Upgrade the Snowflake NodeJS Driver to version 2.0.2 or later on all Linux systems; disable temporary credential caching until the upgrade is complete if immediate patching is not feasible.

How to confirm the fix worked

Confirm the installed driver version is 2.0.2 or newer; review application configuration and environment variables to verify that credential caching is either disabled or the updated driver is in use; test by attempting to place a non-owned file in the cache directory and confirming the driver rejects it.

Typical attack path

  1. Obtain write access to the target user's local Snowflake credential cache directory on Linux
  2. Place an empty file with a predictable cache name in that directory
  3. Wait for or trigger a connection using EXTERNALBROWSER or USERNAME_PASSWORD_MFA with caching enabled
  4. Read the credentials written by the driver into the attacker-controlled file

How to detect it

Search application and system logs for NodeJS process activity writing to the Snowflake credential cache path; inspect file ownership and permissions on files inside the cache directory; look for unexpected empty files created shortly before credential cache updates.

  • snowflake credential cache directory containing files not owned by the running user
  • empty files appearing in ~/.snowflake or equivalent cache paths before credential writes

What your security team should do

  • Immediately upgrade all NodeJS Driver installations to 2.0.2
  • Audit Linux hosts for the presence of the vulnerable driver versions 1.12.0-2.0.1
  • Disable temporary credential caching for EXTERNALBROWSER and MFA flows until upgrades are verified
  • Monitor file creation events in user cache directories for unexpected empty files

The record

### Issue Snowflake discovered and remediated a vulnerability in the Snowflake NodeJS Driver. File permissions checks of the temporary credential cache could be bypassed by an attacker with write access to the local cache directory. This vulnerability affects versions 1.12.0 through 2.0.1 on Linux. Snowflake fixed the issue in version 2.0.2. ### Vulnerability Details On Linux, when either EXTERNALBROWSER or USERNAME_PASSWORD_MFA authentication methods are used with temporary credential caching enabled, the Snowflake NodeJS Driver will cache temporary credentials in a local file. Due to a bug, the check verifying that the cache file can be accessed only by the user running the Driver always succeeded, but didn’t verify the permissions or the ownership correctly. An attacker with write access to the local cache folder could plant an empty file there and the Driver would use it to store temporary credentials instead of rejecting it due to overly broad permissions. ### Solution Snowflake released version 2.0.2 of the Snowflake NodeJS Driver, which fixes this issue. We recommend users upgrade to version 2.0.2. ### Additional Information If you discover a security vulnerability in one of our products or websites, please report the issue to HackerOne. For more information, please see our [Vulnerability Disclosure Policy](https://hackerone.com/snowflake?type=team).

Affected packages

Ecosystem Package Introduced Fixed
npm snowflake-sdk 1.12.0 2.0.2

Related vulnerabilities