CVE-2025-24789: Snowflake JDBC Privilege Escalation Flaw

CVE-2025-24789 Overview

CVE-2025-24789 is a privilege escalation vulnerability in the Snowflake JDBC Driver affecting Windows systems. When the EXTERNALBROWSER authentication method is used, an attacker with write access to a directory in the %PATH% environment variable can escalate their privileges to the user running the vulnerable JDBC Driver. This vulnerability stems from an untrusted search path issue (CWE-426) in how the driver locates and executes external browser processes.

Critical Impact
Local attackers with limited write access to PATH directories can achieve full privilege escalation to any user running Snowflake JDBC-connected Java applications with EXTERNALBROWSER authentication on Windows systems.

Affected Products

Snowflake JDBC Driver versions 3.2.3 through 3.21.0
Microsoft Windows (all versions)
Java applications using Snowflake JDBC with EXTERNALBROWSER authentication

Discovery Timeline

2025-01-29 - CVE-2025-24789 published to NVD
2025-08-20 - Last updated in NVD database

Technical Details for CVE-2025-24789

Vulnerability Analysis

This vulnerability affects the Snowflake JDBC Driver's external browser authentication workflow on Windows systems. When a Java application uses the EXTERNALBROWSER authentication method to connect to Snowflake, the driver attempts to launch a web browser for interactive authentication. The vulnerable code path improperly resolves the browser executable location, allowing an attacker to place a malicious executable in a writable PATH directory that gets executed instead of the legitimate browser.

The attack requires local access with the ability to write to at least one directory included in the Windows %PATH% environment variable. Since many Windows installations include writable directories in PATH (such as the current working directory in some configurations, or user-writable program directories), this creates an exploitable condition.

Root Cause

The root cause is CWE-426: Untrusted Search Path. The Snowflake JDBC Driver did not properly validate or restrict the search path when launching an external browser process on Windows. Instead of using a secure method to invoke the system's default browser, the vulnerable implementation relied on path resolution that could be influenced by attacker-controlled directories.

Attack Vector

The attack requires local access to the target system with the ability to write files to a directory that appears in the Windows %PATH% environment variable. The attacker plants a malicious executable with a predictable name in the writable PATH directory. When a legitimate user runs a Java application that uses the Snowflake JDBC Driver with EXTERNALBROWSER authentication, the malicious executable is launched with the privileges of that user, achieving privilege escalation.

java

 import com.fasterxml.jackson.databind.JsonNode;
 import com.fasterxml.jackson.databind.ObjectMapper;
 import com.google.common.base.Strings;
+import java.awt.Desktop;
 import java.io.BufferedReader;
 import java.io.IOException;
 import java.io.InputStreamReader;

Source: GitHub Commit Change

The patch introduces the use of java.awt.Desktop API for opening external browsers, which provides a more secure method of launching the system's default browser without relying on potentially untrusted PATH resolution.

Detection Methods for CVE-2025-24789

Indicators of Compromise

Suspicious executable files appearing in PATH directories, particularly those mimicking browser process names
Unexpected process launches originating from Java applications using Snowflake JDBC
Modified or newly created executables in user-writable PATH directories with recent timestamps
Anomalous child processes spawned during Snowflake authentication events

Detection Strategies

Monitor file creation events in directories included in system and user PATH variables
Implement endpoint detection rules for process spawning patterns where Java processes launch unexpected executables
Track Snowflake JDBC connection attempts and correlate with process creation events
Audit PATH environment variable configurations across systems for writable directories

Monitoring Recommendations

Enable detailed process auditing on Windows endpoints running Snowflake JDBC applications
Configure SIEM alerts for unusual executable placements in commonly writable PATH directories
Monitor Java application behavior during authentication workflows
Review Snowflake JDBC Driver versions deployed across the environment

How to Mitigate CVE-2025-24789

Immediate Actions Required

Upgrade Snowflake JDBC Driver to version 3.22.0 or later immediately
Audit all Windows systems for writable directories in the PATH environment variable
Review and harden PATH configurations to remove unnecessary writable directories
Consider temporarily disabling EXTERNALBROWSER authentication until patches are applied

Patch Information

Snowflake has released version 3.22.0 of the JDBC Driver which addresses this vulnerability. The fix modifies how the driver opens external browsers by utilizing Java's java.awt.Desktop API instead of relying on PATH-based process resolution. Organizations should update their JDBC driver dependencies immediately. For detailed information about the fix, review the GitHub Security Advisory and the associated commit changes.

Workarounds

Temporarily switch to alternative authentication methods such as SNOWFLAKE (username/password) or OAUTH until the driver can be upgraded
Remove write permissions from all directories in the PATH environment variable
Implement application whitelisting to prevent execution of unauthorized binaries in PATH directories
Use endpoint protection solutions to monitor and block suspicious executable placements

bash

# Audit writable directories in PATH on Windows (PowerShell)
$env:PATH -split ';' | ForEach-Object { 
    if (Test-Path $_) { 
        $acl = Get-Acl $_
        Write-Output "Directory: $_"
        $acl.Access | Where-Object { $_.FileSystemRights -match "Write" } | Format-Table IdentityReference, FileSystemRights
    }
}