Amazon Athena ODBC Driver OS Command Injection Vulnerability in Browser-Based Authentication Component
Vulnerability
A command injection vulnerability has been identified in the Amazon Athena ODBC driver version 2.0.5.1 prior to 2.0.5.1 on Linux. This vulnerability resides in the browser-based authentication component and could allow a threat actor to execute arbitrary code. The issue arises from improper handling of connection parameters, which can be manipulated and loaded by the driver during user-initiated connections.
Impact
Exploitation of this vulnerability could lead to unauthorized execution of commands, allowing for arbitrary code execution on the affected system.
Remediation
Users should upgrade to the Amazon Athena ODBC driver version 2.1.0.0 or later. The updated driver can be downloaded from the AWS Athena ODBC 2.x driver release notes page.
Vulnerability Rating
Our algorithm analyzes dozens of metrics to generate these 8 key vulnerability categories, which are then combined to calculate the overall risk score.