CVE-2024-8055: Vanna SQL Injection Vulnerability

CVE-2024-8055 Overview

CVE-2024-8055 is a SQL injection vulnerability affecting Vanna v0.6.3, an open-source Python library that exposes a text-to-SQL interface through a Flask API. The flaw resides in the library's Snowflake integration, where file staging operations built on the PUT and COPY commands accept unsanitized input. Unauthenticated remote attackers can inject SQL to force the Snowflake connector to read arbitrary local files on the server hosting Vanna, including sensitive files such as /etc/passwd. The weakness is categorized under [CWE-89] (Improper Neutralization of Special Elements used in an SQL Command).

Critical Impact
Unauthenticated attackers can read arbitrary local files from the Vanna host through crafted SQL sent to the Flask API, leading to disclosure of credentials, configuration, and system files.

Affected Products

Vanna v0.6.3
Deployments using Vanna's Snowflake database connector
Applications exposing Vanna through the Python Flask API

Discovery Timeline

2025-03-20 - CVE-2024-8055 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-8055

Vulnerability Analysis

Vanna exposes a natural-language-to-SQL interface that generates and executes SQL against a configured database backend. When Snowflake is the backend, Vanna supports file staging through the Snowflake PUT and COPY commands. These commands are constructed with user-controllable input and passed directly to the Snowflake connector without parameterization or validation.

The Snowflake PUT command reads a file from the local file system of the client executing the query and uploads it to a Snowflake stage. Because the Flask API accepts prompts that are turned into SQL and executed on the server, an attacker can supply a payload that produces a PUT file:///etc/passwd @stage statement. The Snowflake driver, running on the Vanna server, opens the referenced local file and streams its contents to a stage the attacker controls.

Root Cause

The root cause is missing input neutralization in the SQL construction path for Snowflake staging operations. User input flows from the Flask endpoint into query text that is executed by the Snowflake connector. The library does not restrict which statement types can be produced, so file-touching commands are reachable from unauthenticated requests.

Attack Vector

Exploitation requires network access to the Flask API and no authentication or user interaction. An attacker sends a crafted prompt or query that causes Vanna to emit a PUT statement referencing a local file path, followed by a COPY operation that exfiltrates the staged data. The vulnerability affects confidentiality; integrity and availability are not directly impacted.

A sanitized technical description of the exploitation flow is available in the Huntr Bounty Report. No verified public exploit code is included here.

Detection Methods for CVE-2024-8055

Indicators of Compromise

Snowflake query history containing PUT file:// statements referencing local paths such as /etc/passwd, /root/, or application configuration directories
Unexpected COPY INTO operations targeting external or user-created stages shortly after PUT commands
Flask access logs showing anomalous prompt payloads containing SQL keywords like PUT, COPY, or file://

Detection Strategies

Enable Snowflake query history auditing and alert on any PUT or GET statements originating from the Vanna service account.
Inspect Vanna Flask request bodies for prompts that resolve to file-system-touching SQL rather than schema queries.
Correlate outbound network activity from the Vanna host with Snowflake stage uploads to identify data exfiltration attempts.

Monitoring Recommendations

Baseline the SQL statement types Vanna normally emits and flag deviations, especially staging or file-transfer commands.
Monitor read access to sensitive files such as /etc/passwd, .env, and cloud credential files by the Python process hosting Vanna.
Forward Flask and Snowflake driver logs to a centralized analytics platform for retention and threat hunting.

How to Mitigate CVE-2024-8055

Immediate Actions Required

Restrict network exposure of the Vanna Flask API and place it behind authentication and an allowlist of trusted clients.
Rotate any Snowflake credentials used by Vanna and review Snowflake query history for prior abuse of PUT and COPY.
Run the Vanna process under a low-privilege OS account with no read access to sensitive system or credential files.

Patch Information

No fixed version is listed in the NVD entry for CVE-2024-8055. Consult the Huntr Bounty Report and the upstream Vanna project for the latest remediation guidance. Upgrade to a release later than v0.6.3 that removes or sanitizes Snowflake staging operations once available.

Workarounds

Disable or remove the Snowflake connector configuration if file staging is not required for the deployment.
Restrict the Snowflake role used by Vanna so it cannot execute PUT, GET, or create external stages.
Deploy Vanna inside a container with a read-only root filesystem and no access to host credential paths.
Add a reverse proxy or WAF rule that blocks prompts containing PUT file:// or COPY INTO @ patterns.

bash

# Configuration example: restrict Snowflake role privileges used by Vanna
REVOKE CREATE STAGE ON SCHEMA <db>.<schema> FROM ROLE vanna_role;
REVOKE USAGE ON ALL STAGES IN SCHEMA <db>.<schema> FROM ROLE vanna_role;
-- Grant only the minimum needed for read-only analytics
GRANT USAGE ON DATABASE <db> TO ROLE vanna_role;
GRANT USAGE ON SCHEMA <db>.<schema> TO ROLE vanna_role;
GRANT SELECT ON ALL TABLES IN SCHEMA <db>.<schema> TO ROLE vanna_role;