Cloudanix VulnDB

CVE-2025-46328

Low · 3.3

NodeJS Driver for Snowflake has race condition when checking access to Easy Logging configuration file

CVSS

3.3

EPSS

0.2%

Published

Apr 28, 2025

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A bug in the Snowflake connector for Node.js applications on Linux and Mac computers could let someone already on the same machine change where the program writes its activity logs, possibly revealing private information.

Exploitation
Local Privilege
Attacker needs
Local User
Complexity
Moderate
Impact
Data Tampering
Component
Library
Class
Race Condition
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

The Node.js Driver for Snowflake fails to atomically verify file ownership and permissions on the Easy Logging configuration file on Linux and macOS, introducing a TOCTOU race condition that permits a local attacker to overwrite the file and redirect logging output or alter verbosity.

Why it matters to the business

Organizations using affected driver versions on Linux or macOS face risk of local attackers manipulating application logs, which may result in exposure of sensitive query or connection data or loss of audit visibility.

How an attack unfolds

A local attacker identifies or creates a writable logging configuration file or its parent directory, then races the driver’s permission check to replace the file contents before the driver opens it, thereby directing logs to an attacker-chosen location or level.

How to fix it

Upgrade the Snowflake Node.js Driver to version 2.0.4 or later on all Linux and macOS systems; disable the Easy Logging feature until the upgrade is complete if immediate patching is not feasible.

How to confirm the fix worked

Confirm the installed driver version is 2.0.4 or newer via package metadata or npm list; verify that the driver now enforces both owner matching and non-writable-by-others checks on the configuration file path.

Typical attack path

  1. Obtain local shell or write access on the host running the driver
  2. Place or modify a logging configuration file in a location the driver will read
  3. Exploit the TOCTOU window to overwrite the file after the permission check but before use
  4. Configure logging directives to capture sensitive information or write to an attacker-controlled path

How to detect it

Examine system and application logs for unexpected changes to logging configuration files, sudden shifts in log verbosity, or log output appearing in non-standard locations shortly after driver startup.

What your security team should do

  • Immediately upgrade all instances of the Snowflake Node.js Driver to 2.0.4
  • Audit and restrict write permissions on directories that may contain logging configuration files
  • Review application logging configurations to ensure they do not expose sensitive data
  • Monitor for local privilege-escalation attempts on hosts running the driver

The record

# Issue Snowflake discovered and remediated a vulnerability in the NodeJS Driver for Snowflake (“Driver”). When using the Easy Logging feature on Linux and macOS the Driver didn’t correctly verify the permissions of the logging configuration file, potentially allowing an attacker with local access to overwrite the configuration and gain control over logging level and output location. This vulnerability affects Driver versions 1.10.0 through 2.0.3. Snowflake fixed the issue in version 2.0.4. # Vulnerability Details When using the Easy Logging feature on Linux and macOS the Driver reads logging configuration from a user-provided file. On Linux and macOS the Driver verifies that the configuration file can be written to only by its owner. That check was vulnerable to a Time-of-Check to Time-of-Use (TOCTOU) race condition and failed to verify that the file owner matches the user running the Driver. This could allow a local attacker with write access to the configuration file or the directory containing it to overwrite the configuration and gain control over logging level and output location. # Solution Snowflake released version 2.0.4 of the NodeJS Driver for Snowflake, which fixes this issue. We recommend users upgrade to version 2.0.4. # Additional Information If you discover a security vulnerability in one of our products or websites, please report the issue to Snowflake through our Vulnerability Disclosure Program hosted at HackerOne. For more information, please see our [Vulnerability Disclosure Policy](https://hackerone.com/snowflake?type=team).

Affected packages

Ecosystem Package Introduced Fixed
npm snowflake-sdk 1.10.0 2.0.4

Related vulnerabilities