Snowflake Connector for Python SQL Injection Vulnerability

A SQL injection vulnerability has been identified in the Snowflake Connector for Python, specifically in the 'snowflake.connector.pandas_tools' module. This issue affects versions 2.2.5 through 3.13.0. The vulnerability arises because a function in the 'pandas_tools' module does not properly sanitize all input arguments, allowing an attacker to inject malicious SQL that is executed within the context of the current session.

Impact

Exploitation of this vulnerability allows for SQL injection, where an attacker can manipulate SQL queries to execute arbitrary SQL commands in the context of the current session.

Reproduction

The vulnerability can be reproduced by using a version of the Snowflake Connector for Python that is between 2.2.5 and 3.13.0. A crafted input can be passed to the vulnerable function in the 'pandas_tools' module, which will then be executed as part of an SQL query without proper sanitization or parameterization.

Remediation

Users are advised to upgrade to version 3.13.1 of the Snowflake Connector for Python, which addresses this vulnerability.