Staging Environment: Content and features may be unstable or change without notice.
Advisory details: github_osv / GHSA-7hpq-3g6w-pvhf
Advisory ID github_osv/GHSA-7hpq-3g6w-pvhf
Aliases CVE-2025-24789
Summary Snowflake JDBC allows an untrusted search path on Windows ### Issue Snowflake discovered and remediated a vulnerability in the Snowflake JDBC Driver. When the EXTERNALBROWSER authentication method is used on Windows, an attacker with write access to a directory in the %PATH% can escalate their privileges to the user that runs the vulnerable JDBC Driver version. This vulnerability affects versions 3.2.3 through 3.21.0 on Windows. Snowflake fixed the issue in version 3.22.0. ### Vulnerability Details When the EXTERNALBROWSER authentication method is selected, the Snowflake JDBC Driver on non-macOS operating systems tries to open the SSO URL using xdg-open. Because xdg-open is a Linux program that doesn’t exist in a default Windows installation, a sufficiently privileged attacker could place a malicious executable in one of the directories on the %PATH% and achieve local privilege escalation to the user running the JDBC Driver. ### Solution Snowflake released version 3.22.0 of the Snowflake JDBC Driver, which fixes this issue. We recommend users upgrade to version 3.22.0. ### Additional Information If you discover a security vulnerability in one of our products or websites, please report the issue to HackerOne. For more information, please see our [Vulnerability Disclosure Policy](https://hackerone.com/snowflake?type=team).
Status Published
Exploitability 0.5
Weighted Severity 7.0
Risk 3.5
Affected and Fixed Packages Package Details
Introduced and Fixed Package Commit Patches Package Commit Patches Details
Weaknesses (1)
CWE-426 Untrusted Search Path
System Score Found at
cvssv3.1 7.8 https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/01/GHSA-7hpq-3g6w-pvhf/GHSA-7hpq-3g6w-pvhf.json
generic_textual HIGH
Reference id Reference type URL
https://github.com/snowflakedb/snowflake-jdbc
4f01bb8f9b708c71e7a2111c87371dbfc1d53dd6 Other https://github.com/snowflakedb/snowflake-jdbc/commit/4f01bb8f9b708c71e7a2111c87371dbfc1d53dd6
CVE-2025-24789 https://nvd.nist.gov/vuln/detail/CVE-2025-24789
GHSA-7hpq-3g6w-pvhf Other https://github.com/snowflakedb/snowflake-jdbc/security/advisories/GHSA-7hpq-3g6w-pvhf
No exploits are available.

No EPSS data available for this advisory.

Patch URL
There are no known patches.
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Found at https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/01/GHSA-7hpq-3g6w-pvhf/GHSA-7hpq-3g6w-pvhf.json
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none

There are no SSVC decisions available.