Snowflake GitHub Actions Flaw Lets Crafted Issues Trigger Command Injection
Summary
Researchers at Wiz have discovered a GitHub Actions workflow injection vulnerability in Snowflake's public snowflakedb/snowflake-connector-net repository. This flaw could allow an attacker to execute commands within a workflow by submitting a specially crafted GitHub issue, potentially exposing internal Jira credentials.
IFF Assessment
The vulnerability allows for command injection and potential credential exposure, which is detrimental to defenders.
Severity
The vulnerability allows for Remote Code Execution (RCE) via a crafted GitHub issue. The attack vector is through the network and requires a low level of privileges (user creating an issue). The impact on confidentiality, integrity, and availability is high due to potential command execution and credential theft.
Defender Context
This vulnerability highlights the risks associated with overly permissive GitHub Actions workflows, especially when they handle sensitive credentials. Defenders should scrutinize their CI/CD pipelines for similar injection flaws and implement strict controls on workflow permissions and inputs.