Snowflake GitHub Actions Flaw Exposes Internal Credentials
A workflow injection vulnerability in Snowflake's public GitHub repository could expose internal Jira credentials. The flaw resided in a YAML file that processed GitHub issues.
TL;DR
- Wiz researchers found a command injection flaw in Snowflake's GitHub Actions workflow.
- The vulnerability was in snowflakedb/snowflake-connector-net repository.
- Attackers could exploit it by submitting crafted GitHub issues.
- Compromised workflow exposed internal Jira credentials.
- Organizations should audit public repository workflows for similar risks.
Cybersecurity researchers at Wiz have uncovered a critical workflow injection vulnerability in Snowflake's public GitHub repository. The flaw allowed attackers to execute arbitrary commands through specially crafted GitHub issues, potentially gaining access to sensitive internal credentials.
The vulnerability existed in the snowflakedb/snowflake-connector-net repository's automated workflow configuration. This type of flaw highlights the importance of securing CI/CD pipelines and carefully validating external inputs in automated processes.
Vulnerability Details
- The flaw was located in .github/workflows/jira_issue.yml file
- Workflow automatically processed GitHub issues without proper input sanitization
- Command injection was possible through issue content manipulation
- Internal Jira credentials were accessible to compromised workflows
Security Implications
- Attackers could extract sensitive internal system credentials
- Automated workflows may bypass traditional security controls
- Public repositories increase attack surface for supply chain attacks
- Credential exposure could lead to lateral movement within organization
Remediation Steps
- Audit all GitHub Actions workflows for input validation gaps
- Implement strict filtering for external issue content processing
- Rotate exposed credentials and monitor for unauthorized usage
- Review public repository permissions and automated workflow triggers
Sources
Sources
Security email updates
One digest email when we publish new security articles (TL;DR plus links to read more). Unsubscribe anytime from the message footer. See our Privacy Policy.