Eskalation von Privilegien in Snowflake Hive MetaStore Connector Helper-Skript

This vulnerability allows a malicious insider, lacking administrative privileges, to potentially compromise a system. The attacker could exploit the helper script to download content from a Microsoft domain, then replace this content with malicious code. If the attacker gains local access to the system where the modified script is executed, they could then attempt to manipulate users into executing the malicious code. This could lead to unauthorized access, data breaches, or further system compromise. The potential impact is significant, particularly in environments where the Hive MetaStore Connector is used to manage sensitive data.

Organizations utilizing the Snowflake Hive MetaStore Connector, particularly those with insider threat concerns or environments where local system access is not strictly controlled, are at risk. Specifically, deployments where the connector is used to access sensitive data or critical business processes should be prioritized for remediation.

• java / server:

ps -ef | grep "Snowflake Hive MetaStore Connector"

• java / supply-chain: Review the helper script's source code for any unexpected modifications or suspicious code patterns. • generic web: Monitor Snowflake audit logs for unusual script execution patterns or unauthorized access attempts to the Hive MetaStore Connector.

1. 2024-03-15Disclosure

   disclosure

1. Reserviert2024-03-11
2. Veröffentlicht2024-03-15
3. Geändert2024-08-28
4. EPSS aktualisiert2026-04-02

The primary mitigation for CVE-2024-28851 is to upgrade the Snowflake Hive MetaStore Connector to version dfbf87dff4 or later. If an immediate upgrade is not possible, consider restricting access to the helper script and closely monitoring its execution. Implement strict access controls and least privilege principles to limit the potential impact of a successful exploitation. Review and audit the script's functionality to identify any potential vulnerabilities. After upgrading, confirm the fix by verifying the connector version and reviewing system logs for any suspicious activity.