Security researchers at Wiz, a cloud security company, have identified a critical script injection vulnerability in a public GitHub repository maintained by Snowflake. The flaw, found in the `snowflakedb/snowflake-connector-net` repository, specifically affected its GitHub Actions workflows.
The vulnerability, which was discovered by Wiz Research's Red Agent, an autonomous AI-powered security research tool, allowed an unauthenticated user to execute arbitrary commands within a GitHub Actions runner. This could be achieved by creating a GitHub issue with a specially crafted title.
Wiz researchers were conducting security research through Snowflake's HackerOne vulnerability disclosure program when the Red Agent identified the issue on June 23. The vulnerability originated from a pull request, #1218, which was merged on GitHub on June 18.
Notably, GitHub's Advanced Security scan, which incorporates GitHub Copilot Autifix, analyzed the final revision of the pull request, including the vulnerable workflow, but failed to flag the critical injection. Gal Nagli, head of threat exposure at Wiz Research, highlighted this oversight in a report.
The Wiz Research autonomous agent not only discovered the GitHub Actions injection but also independently exploited it. It validated access to sensitive data within Snowflake's internal Jira connector and assessed the potential impact, all without human intervention.
Wiz reported the vulnerability to Snowflake via HackerOne on June 23. Snowflake responded promptly, patching the vulnerable script-injection workflow (commit 1dc7766, PR #1402) on the same day. Additionally, Snowflake rotated the affected Jira token on June 24.
Snowflake confirmed the remediation in a public disclosure, stating that the issue was immediately investigated and addressed. The company's investigation found no evidence of unauthorized access resulting from the vulnerability. Snowflake also indicated its intention to collaborate with Wiz to share these findings with the broader industry, encouraging the adoption of enhanced security practices.
