Snowflake JDBC Driver Temporary Credential Caching Vulnerability on Linux

A vulnerability exists in the Snowflake JDBC Driver, specifically in versions 3.6.8 through 3.21.0, that relates to how temporary credentials are cached on Linux systems. When temporary credential caching is enabled and certain authentication methods are used, the driver stores these credentials in a local file with world-readable permissions. This issue could expose sensitive information to other users on the same system.

Impact

The vulnerability allows for unauthorized access to temporary credentials, which could be misused to authenticate as a user in Snowflake.

Reproduction

To reproduce this vulnerability, use the Snowflake JDBC Driver version 3.6.8 to 3.21.0 on a Linux system. Enable temporary credential caching and use either the EXTERNALBROWSER or USERNAME_PASSWORD_MFA authentication methods. The driver will cache temporary credentials in a file located in the user's home directory, within a '.cache/snowflake2' folder. This file will have permissions that allow it to be read by any user on the system.

Remediation

Upgrade to version 3.22.0 of the Snowflake JDBC Driver, which addresses this vulnerability by ensuring that the temporary credential cache file is not world-readable.