Overview
In the real-world vulnerability CVE-2024-8055, Vanna v0.6.3 allowed an attacker to manipulate SQL queries exposed by a Flask API that drives Snowflake’s file staging (PUT and COPY). Because the API accepted user-controlled input and interpolated it directly into SQL, unauthenticated remote users could influence the SQL sent to Snowflake. In susceptible deployments, this could lead to reading arbitrary local files on the host, such as /etc/passwd, by leaking or exfiltrating server-side file content through crafted staging commands. This exposes not only data on the host but also broader attacker footholds in the app and environment. The CWE linked to this class is CWE-89: Improper Neutralization of User Input for SQL Commands (SQL Injection).
Flask apps that expose endpoints performing database or staging operations must treat user input as untrusted. The vulnerability manifests when a Flask API concatenates request parameters into SQL strings that are then sent to Snowflake. Attackers can alter the intended command by injecting SQL fragments, causing the backend to execute unintended actions. The impact profile includes data disclosure, possible file system access on the host, and broader persistence risks if an attacker can chain commands or extract credentials from misconfigured components.
Remediating this class of issue in Flask involves: (1) upgrading to patched libraries (e.g., a fixed Vanna release) and applying vendor advisories for CVE-2024-8055; (2) eliminating string interpolation of untrusted input into SQL; (3) using parameterized queries or bound parameters supported by the Snowflake Python connector; (4) validating and constraining inputs with a strict allowlist, or moving staging logic behind a controlled backend service with restricted privileges; (5) enforcing authentication and least-privilege access to Snowflake roles and staging locations; and (6) adding logging, monitoring, and security tests to CI to prevent regressions.)
Affected Versions
Vanna v0.6.3
Code Fix Example
Flask API Security Remediation
from flask import Flask, request
import snowflake.connector
app = Flask(__name__)
ctx = snowflake.connector.connect(user='user', password='pass', account='acct')
cs = ctx.cursor()
@app.route('/stage', methods=['POST'])
def stage_vuln():
path = request.form.get('path')
# Vulnerable: concatenating untrusted input into SQL
sql = f"PUT file://{path} @my_stage; COPY INTO @my_stage FROM 'file://{path}' FILE_FORMAT=(TYPE='CSV')"
cs.execute(sql)
return 'OK'
@app.route('/stage_fix', methods=['POST'])
def stage_fix():
path = request.form.get('path')
if not path:
return 'missing', 400
full_uri = "file://" + path
# Fixed: parameterized query to avoid injection
sql = "COPY INTO @my_stage FROM %s FILE_FORMAT=(TYPE='CSV')"
cs.execute(sql, (full_uri,))
return 'OK'
if __name__ == '__main__':
app.run()