CVE-2024-28851: Privilege Escalation in Snowflake Hive Connector

The core of this vulnerability lies in a helper script used by the Snowflake Hive MetaStore Connector. An attacker with insider access can exploit this by downloading content from a Microsoft domain, replacing the legitimate script with a malicious variant, and then leveraging local access to execute the modified script. Successful exploitation could allow the attacker to manipulate users, potentially gaining unauthorized access to data or systems within the Snowflake environment. While the description mentions user manipulation, the precise scope of that manipulation isn't fully detailed, but the potential for unauthorized actions is significant.

1. Reserved2024-03-11
2. Published2024-03-15
3. Modified2024-08-28
4. EPSS updated2026-04-02

The primary mitigation for CVE-2024-28851 is to upgrade the Snowflake Hive MetaStore Connector to version dfbf87dff4 or later. Prior to upgrading, assess the potential impact on existing queries and workflows that rely on the connector. Consider performing a staged rollout to minimize disruption. If an immediate upgrade is not feasible, restrict access to the helper script and closely monitor its execution for any suspicious activity. After upgrading, confirm the fix by verifying the script integrity and reviewing audit logs for any unauthorized modifications.