Detections
Analytics

SCA: security update for snowflake-sdk (GHSA-h53w-7qw7-vh5c)

high Tenable Cloud Security Plugin ID 415476

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - snowflake-connector-nodejs, a NodeJS driver for Snowflake, is vulnerable to command injection via single
 sign on (SSO) browser URL authentication in versions prior to 1.6.21. In order to exploit the potential
 for command injection, an attacker would need to be successful in (1) establishing a malicious resource
 and (2) redirecting users to utilize the resource. The attacker could set up a malicious, publicly
 accessible server which responds to the SSO URL with an attack payload. If the attacker then tricked a
 user into visiting the maliciously crafted connection URL, the user’s local machine would render the
 malicious payload, leading to a remote code execution. This attack scenario can be mitigated through URL
 whitelisting as well as common anti-phishing resources. Version 1.6.21 contains a patch for this issue.
 (CVE-2023-34232)

See Also

https://github.com/advisories/GHSA-h53w-7qw7-vh5c

Plugin Details

Severity: High

ID: 415476

Version: Revision 1.9

Type: Local

Family: SCA Checks

Published: 1/23/2025

Updated: 7/2/2026

Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Medium

Score: 4.9

Percentile: 57.58

Vendor

Vendor Severity: High

CVSS v2

Risk Factor: Critical

Base Score: 10

Temporal Score: 7.4

Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C

CVSS Score Source: CVE-2023-34232

CVSS v3

Risk Factor: High

Base Score: 8.8

Temporal Score: 7.7

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 6/9/2023

Vulnerability Publication Date: 6/8/2023

Reference Information

CVE: CVE-2023-34232

cwe: CWE-77