CVE-2024-12744: AWS Redshift JDBC Driver SQLi Vulnerability

CVE-2024-12744 Overview

CVE-2024-12744 is a SQL injection vulnerability affecting the Amazon Redshift Java Database Connectivity (JDBC) Driver version 2.1.0.31. The flaw resides in the driver's metadata APIs, specifically getSchemas, getTables, and getColumns. An authenticated user can inject SQL through these methods to gain escalated privileges within the Redshift environment.

Amazon Web Services addressed the issue in driver version 2.1.0.32. The earlier 2.1.0.30 release is also unaffected. The vulnerability is classified under CWE-89, Improper Neutralization of Special Elements used in an SQL Command.

Critical Impact
An authenticated attacker can escalate privileges in Amazon Redshift by injecting SQL through JDBC driver metadata APIs, potentially exposing sensitive data warehouse contents.

Affected Products

Amazon Redshift JDBC Driver version 2.1.0.31
Applications and services that bundle or ship with the affected driver version
ETL, BI, and analytics tools using the vulnerable JDBC driver against Amazon Redshift clusters

Discovery Timeline

2024-12-24 - CVE-2024-12744 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-12744

Vulnerability Analysis

The Amazon Redshift JDBC Driver exposes JDBC DatabaseMetaData methods that internally build SQL queries against Redshift system catalogs. In version 2.1.0.31, the driver fails to properly neutralize input passed to getSchemas, getTables, and getColumns before including it in the constructed queries.

A user who can influence the arguments passed to these metadata APIs can inject additional SQL fragments. Because the driver executes these queries with the caller's session, the injected SQL runs with the effective permissions available to that connection. In environments where the connection uses a role with broader privileges than the requesting user, this results in privilege escalation.

The issue is a classic string-concatenation flaw in metadata query construction. It does not require unauthenticated access; the attacker must already have a valid JDBC connection but can then reach data or catalogs beyond their intended scope.

Root Cause

The root cause is improper neutralization of user-supplied identifiers within the metadata API implementations. Instead of binding parameters or strictly validating schema, table, and column filter arguments, the driver incorporates them directly into catalog queries. This allows special SQL characters and clauses to break out of the intended query context.

Attack Vector

Exploitation requires network access to a Redshift endpoint and valid credentials on the target cluster. An attacker crafts input to a metadata API call, either directly through custom Java code or by manipulating an upstream application that forwards user-supplied filter strings to DatabaseMetaData.getSchemas, getTables, or getColumns. Applications that expose search or catalog-browsing functionality backed by these APIs are the most likely exposure surface.

The vulnerability mechanism is described in the AWS Security Bulletin AWS-2024-015 and the GitHub Security Advisory GHSA-8596-2jgr-ppj7. No public proof-of-concept code has been published.

Detection Methods for CVE-2024-12744

Indicators of Compromise

Presence of redshift-jdbc42-2.1.0.31.jar or equivalent artifact on application servers, ETL hosts, or developer workstations
Unusual Redshift catalog queries against pg_catalog, svv_*, or information_schema views containing embedded SQL keywords such as UNION, --, or ; inside identifier positions
Redshift STL_QUERY or SYS_QUERY_HISTORY entries showing metadata lookups followed by unexpected data-plane queries from the same session

Detection Strategies

Inventory Java applications and container images to identify usage of Redshift JDBC driver version 2.1.0.31
Enable Redshift audit logging and hunt for anomalous SQL patterns originating from JDBC sessions, particularly queries that mix metadata catalog references with UNION SELECT or subquery constructs
Correlate application logs that pass user input into JDBC metadata calls with Redshift-side query logs to detect injected payloads

Monitoring Recommendations

Stream Redshift audit logs and application logs into a centralized analytics platform for correlation and long-term retention
Alert on privilege-sensitive activity, such as reads against tables that the invoking user is not expected to access
Track software bill of materials (SBOM) changes so that vulnerable JDBC driver versions reintroduced via dependency updates trigger a review

How to Mitigate CVE-2024-12744

Immediate Actions Required

Upgrade the Amazon Redshift JDBC Driver to version 2.1.0.32 or later in all applications, ETL jobs, notebooks, and BI tools
If upgrading is not immediately feasible, revert to driver version 2.1.0.30, which is not affected
Rotate Redshift credentials used by applications that ran the vulnerable driver if injection activity is suspected
Review Redshift IAM roles and database grants to enforce least privilege for JDBC service accounts

Patch Information

Amazon Web Services published the fix in Redshift JDBC Driver v2.1.0.32. Details are provided in the AWS Security Bulletin AWS-2024-015 and the GitHub Security Advisory GHSA-8596-2jgr-ppj7. Update Maven, Gradle, or direct JAR dependencies accordingly.

Workarounds

Downgrade to Amazon Redshift JDBC Driver version 2.1.0.30 until version 2.1.0.32 can be deployed
Validate and sanitize any user-supplied values before passing them to DatabaseMetaData.getSchemas, getTables, or getColumns
Restrict Redshift database roles used by JDBC clients so that any successful injection has minimal privileges to abuse

bash

# Maven dependency update example
# Replace the vulnerable driver version with the fixed release
# pom.xml
<dependency>
  <groupId>com.amazon.redshift</groupId>
  <artifactId>redshift-jdbc42</artifactId>
  <version>2.1.0.32</version>
</dependency>

# Verify installed driver JARs on application hosts
find / -name 'redshift-jdbc42-*.jar' 2>/dev/null