CVE-2024-12746: Amazon Redshift ODBC Driver SQLi Flaw

CVE-2024-12746 Overview

CVE-2024-12746 is a SQL injection vulnerability in the Amazon Redshift Open Database Connectivity (ODBC) Driver version 2.1.5.0 on Windows and Linux. The flaw resides in the SQLTables and SQLColumns Metadata Application Programming Interfaces (APIs). An authenticated user can inject crafted SQL through these metadata calls to gain escalated privileges within the connected Redshift environment. The issue is tracked under CWE-89: Improper Neutralization of Special Elements used in an SQL Command. Amazon addressed the vulnerability in driver version 2.1.6.0, and administrators can alternatively revert to 2.1.4.0. Full details are documented in AWS Security Bulletin AWS-2024-015 and GitHub Security Advisory GHSA-g63m-5vjv-wr3v.

Critical Impact
An authenticated user can escalate privileges in Amazon Redshift by injecting SQL through metadata API calls handled by the vulnerable ODBC driver.

Affected Products

Amazon Redshift ODBC Driver v2 version 2.1.5.0 (Windows)
Amazon Redshift ODBC Driver v2 version 2.1.5.0 (Linux)
Applications and Business Intelligence tools relying on this driver version for Redshift connectivity

Discovery Timeline

2024-12-24 - CVE-2024-12746 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in the NVD database

Technical Details for CVE-2024-12746

Vulnerability Analysis

The vulnerability sits in the ODBC driver's implementation of two catalog metadata functions: SQLTables and SQLColumns. These APIs allow client applications to enumerate tables, views, and columns available in a data source. The driver constructs backend queries from arguments passed to these calls without adequately neutralizing SQL syntax. An authenticated user who controls or influences the arguments passed to these metadata calls can inject additional SQL statements. Those statements execute in the security context tied to the connection, enabling privilege escalation beyond what the calling identity is otherwise granted.

Exploitation requires network reachability to Redshift, valid credentials, and typically a user interaction path through an application that invokes the affected metadata APIs. The impact spans confidentiality, integrity, and availability of the Redshift cluster data accessed through the driver.

Root Cause

The root cause is improper neutralization of special SQL elements ([CWE-89]) inside the driver's metadata API handlers. Argument values supplied to SQLTables and SQLColumns flow into dynamically built SQL sent to Redshift without parameterization or sufficient escaping. This allows attacker-controlled tokens to break out of the intended query structure.

Attack Vector

An authenticated attacker crafts a malicious catalog, schema, table, or column name string and submits it through an application feature that ultimately calls SQLTables or SQLColumns via the vulnerable driver. The injected SQL executes against Redshift with the privileges of the connection, allowing operations the user would not normally be authorized to perform. See the GitHub Security Advisory GHSA-g63m-5vjv-wr3v for technical details.

// No verified public proof-of-concept code is available for CVE-2024-12746.
// The vulnerability is exercised by supplying attacker-controlled identifier
// strings to the SQLTables or SQLColumns ODBC metadata APIs, which the driver
// concatenates into backend SQL sent to Amazon Redshift.

Detection Methods for CVE-2024-12746

Indicators of Compromise

Redshift query logs containing unexpected SQL fragments, comments, or stacked statements appearing inside catalog metadata lookups
ODBC client hosts running Amazon Redshift ODBC Driver version 2.1.5.0 as reported by software inventory
Unusual privilege changes, GRANT statements, or access to sensitive tables shortly after metadata API calls from user sessions

Detection Strategies

Enable and review Redshift STL_QUERY and audit logs for metadata queries containing SQL delimiters such as ;, --, /*, or UNION inside identifier arguments
Inventory installed ODBC drivers on Windows and Linux clients and flag any instance of Redshift ODBC Driver 2.1.5.0
Correlate connection identity with subsequent privileged operations to detect escalations that follow catalog enumeration

Monitoring Recommendations

Forward Redshift audit logs and client ODBC event logs to a centralized analytics platform for retention and query
Alert on GRANT, REVOKE, or role membership changes originating from user roles that should not perform privilege administration
Track deployment status of driver 2.1.6.0 across managed endpoints and Business Intelligence servers

How to Mitigate CVE-2024-12746

Immediate Actions Required

Upgrade the Amazon Redshift ODBC Driver to version 2.1.6.0 on all Windows and Linux clients, as directed in AWS Security Bulletin AWS-2024-015
If upgrading is not immediately possible, revert to driver version 2.1.4.0, which is not affected
Audit Redshift user privileges and revoke unnecessary rights that would amplify the impact of a successful injection
Rotate credentials for accounts that connected through the vulnerable driver version

Patch Information

Amazon released the fix in Amazon Redshift ODBC Driver v2 version 2.1.6.0. Download details and release notes are available on the GitHub Release v2.1.6 page. Administrators should validate driver versions across desktop clients, ETL servers, and Business Intelligence platforms after deployment.

Workarounds

Downgrade to Amazon Redshift ODBC Driver v2 version 2.1.4.0 until the 2.1.6.0 upgrade can be scheduled
Restrict Redshift user permissions to the minimum required, limiting the effective outcome of any injected statements
Constrain network access to Redshift endpoints so that only trusted hosts running patched drivers can connect

bash

# Verify installed Amazon Redshift ODBC Driver version on Linux
odbcinst -q -d -n "Amazon Redshift ODBC Driver"
dpkg -l | grep -i amazonredshift   # Debian/Ubuntu
rpm -qa | grep -i amazonredshift   # RHEL/CentOS/Amazon Linux

# Windows (PowerShell)
Get-OdbcDriver -Name "*Amazon Redshift*" | Select-Object Name, Platform