CVE-2023-34231 (published 2023-06-08T20:15Z)

gosnowflake is th Snowflake Golang driver. Prior to version 1.6.19, a command injection vulnerability exists in the Snowflake Golang driver via single sign-on (SSO) browser URL authentication. In order to exploit the potential for command injection, an attacker would need to be successful in (1) establishing a malicious resource and (2) redirecting users to utilize the resource. The attacker could set up a malicious, publicly accessible server which responds to the SSO URL with an attack payload. If the attacker then tricked a user into visiting the maliciously crafted connection URL, the user’s local machine would render the malicious payload, leading to a remote code execution. This attack scenario can be mitigated through URL whitelisting as well as common anti-phishing resources. A patch is available in version 1.6.19.

CVSS v3 base score: 8.8, HIGH (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-77
cwe_name: Improper Neutralization of Special Elements used in a Command ('Command Injection')
description: The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.
extended_description: 
            Many protocols and products have their own custom command language. While OS or shell command strings are frequently discovered and targeted, developers may not realize that these other command languages might also be vulnerable to attacks.
         
         

Fix information:
repo_url: https://github.com/snowflakedb/gosnowflake
commit_details: repo_url: https://github.com/snowflakedb/gosnowflake
author: Harsh Chaturvedi
author_date: 2023-03-20 17:24:48-07:00
msg: SNOW-761744 Added URL Validator and URL Encoder (#757)
repository: repo_url: https://github.com/snowflakedb/gosnowflake
repo_name: snowflakedb/gosnowflake
description: Go Snowflake Driver
repo_language: Go
owner: snowflakedb
file_changes: filename: url_util.go
change_type: ModificationType.ADD
diff: @@ -0,0 +1,29 @@
+package gosnowflake
+
+import (
+	"net/url"
+	"regexp"
+)
+
+var (
+	matcher, _ = regexp.Compile(`^http(s?)\:\/\/[0-9a-zA-Z]([-.\w]*[0-9a-zA-Z@:])*(:(0-9)*)*(\/?)([a-zA-Z0-9\-\.\?\,\&\(\)\/\\\+&%\$#_=@]*)?$`)
+)
+
+func isValidURL(targetURL string) bool {
+	if !matcher.MatchString(targetURL) {
+		logger.Infof(" The provided URL is not a valid URL - " + targetURL)
+		return false
+	}
+	return true
+}
+
+func urlEncode(targetString string) string {
+	// We use QueryEscape instead of PathEscape here
+	// for consistency across Drivers. For example:
+	// QueryEscape escapes space as "+" whereas PE
+	// it as %20F. PE also does not escape @ or &
+	// either but QE does.
+	// The behavior of QE in Golang is more in sync
+	// with URL encoders in Python and Java hence the choice
+	return url.QueryEscape(targetString)
+}

programming_language: Go
filename: util_test.go
change_type: ModificationType.MODIFY
diff: @@ -230,3 +230,44 @@ func TestGetMin(t *testing.T) {
 		}
 	}
 }
+
+type tcURLList struct {
+	in  string
+	out bool
+}
+
+func TestValidURL(t *testing.T) {
+	testcases := []tcURLList{
+		{"https://ssoTestURL.okta.com", true},
+		{"https://ssoTestURL.okta.com:8080", true},
+		{"https://ssoTestURL.okta.com/testpathvalue", true},
+		{"-a calculator", false},
+		{"This is a random test", false},
+		{"file://TestForFile", false},
+	}
+	for _, test := range testcases {
+		result := isValidURL(test.in)
+		if test.out != result {
+			t.Errorf("Failed to validate URL, input :%v, expected: %v, got: %v", test.in, test.out, result)
+		}
+	}
+}
+
+type tcEncodeList struct {
+	in  string
+	out string
+}
+
+func TestEncodeURL(t *testing.T) {
+	testcases := []tcEncodeList{
+		{"Hello @World", "Hello+%40World"},
+		{"Test//String", "Test%2F%2FString"},
+	}
+
+	for _, test := range testcases {
+		result := urlEncode(test.in)
+		if test.out != result {
+			t.Errorf("Failed to encode string, input %v, expected: %v, got: %v", test.in, test.out, result)
+		}
+	}
+}

programming_language: Go