CVE-2025-24794: Snowflake Connector Privilege Escalation

CVE-2025-24794 Overview

The Snowflake Connector for Python contains an insecure deserialization vulnerability in its OCSP response cache implementation. The connector, which provides an interface for developing Python applications that connect to Snowflake and perform standard database operations, uses Python's pickle module as the serialization format for caching OCSP (Online Certificate Status Protocol) responses. This design flaw can potentially lead to local privilege escalation when a malicious actor can manipulate the cache file.

Critical Impact

Local attackers with write access to the OCSP cache file can execute arbitrary code with the privileges of the application using the Snowflake Connector, potentially leading to full system compromise.

Affected Products

• Snowflake Connector for Python versions 2.7.12 through 3.13.0
• Python applications using affected connector versions for Snowflake database connectivity
• Systems with writable OCSP response cache directories accessible to untrusted users

Discovery Timeline

• January 29, 2025 - CVE-2025-24794 published to NVD
• August 25, 2025 - Last updated in NVD database

Technical Details for CVE-2025-24794

Vulnerability Analysis

This vulnerability is classified under CWE-502 (Deserialization of Untrusted Data), a well-known class of security issues in Python applications. The Snowflake Connector uses pickle serialization to cache OCSP responses for certificate validation, which is inherently dangerous when the cache file can be modified by untrusted parties.

Python's pickle module is known to be insecure when deserializing data from untrusted sources because it can execute arbitrary Python code during the deserialization process. An attacker who can write to the OCSP cache file location can craft a malicious pickle payload that executes code when the connector loads the cache.

The vulnerability requires local access to the system where the connector is running, making it a local privilege escalation vector rather than a remote attack. The attack complexity is low, requiring only basic write access to the cache file location.

Root Cause

The root cause is the use of Python's pickle module for serializing and deserializing OCSP response cache data. Pickle is fundamentally unsafe for untrusted data because it allows arbitrary code execution during deserialization through the __reduce__ method or similar mechanisms. The cache files stored by the connector could be modified by a local attacker to contain malicious serialized objects.

Attack Vector

The attack requires local access to the system running the Snowflake Connector for Python. An attacker with write permissions to the OCSP cache file can replace or modify the cached data with a malicious pickle payload. When the connector subsequently reads and deserializes this cache file, the malicious code executes with the privileges of the application.

The fix introduces secure file handling through the owner_rw_opener function and adds a load_if_file_exists parameter to control cache loading behavior:

     ProgrammingError,
     ServiceUnavailableError,
 )
+from ..file_util import owner_rw_opener
 from ..network import (
     ACCEPT_TYPE_APPLICATION_SNOWFLAKE,
     CONTENT_TYPE_APPLICATION_JSON,

Source: GitHub Commit Fix

The cache implementation was also updated to include additional security controls:

         file_path: str | dict[str, str],
         entry_lifetime: int = constants.DAY_IN_SECONDS,
         file_timeout: int = 0,
+        load_if_file_exists: bool = True,
     ) -> None:
         """Inits an SFDictFileCache with path, lifetime.

Source: GitHub Commit Fix

Detection Methods for CVE-2025-24794

Indicators of Compromise

• Unexpected modifications to OCSP cache files in the Snowflake Connector cache directory
• Unusual process spawning from Python applications using the Snowflake Connector
• File integrity changes to cache files with serialized Python objects
• Anomalous file access patterns targeting the connector's cache locations

Detection Strategies

• Monitor file system integrity for modifications to Snowflake Connector cache directories
• Implement application whitelisting to detect unauthorized code execution from Python processes
• Use endpoint detection to identify pickle deserialization attacks and related exploitation patterns
• Audit installed Python package versions to identify vulnerable Snowflake Connector installations

Monitoring Recommendations

• Enable file integrity monitoring on directories containing OCSP cache files
• Monitor for suspicious process creation chains originating from Python applications
• Track file permission changes on cache directories that may indicate preparation for exploitation
• Review application logs for unexpected errors during OCSP cache loading operations

How to Mitigate CVE-2025-24794

Immediate Actions Required

• Upgrade the Snowflake Connector for Python to version 3.13.1 or later immediately
• Audit systems for any installations using vulnerable versions (2.7.12 through 3.13.0)
• Review file permissions on OCSP cache directories to restrict write access
• Monitor for any suspicious activity related to pickle deserialization attempts

Patch Information

Snowflake has released version 3.13.1 of the Snowflake Connector for Python to address this vulnerability. The fix implements secure file handling through the owner_rw_opener function and adds additional controls for cache file loading. Organizations should upgrade all instances of the connector to the patched version. Detailed information about the fix is available in the GitHub Security Advisory.

Workarounds

• Restrict file system permissions on OCSP cache directories to prevent unauthorized write access
• Run applications using the Snowflake Connector with minimal required privileges
• Implement mandatory access controls (SELinux, AppArmor) to limit cache file modifications
• Consider disabling OCSP caching temporarily if upgrading is not immediately possible

# Upgrade Snowflake Connector for Python to patched version
pip install --upgrade snowflake-connector-python>=3.13.1

# Verify installed version
pip show snowflake-connector-python | grep Version

# Restrict cache directory permissions (example)
chmod 700 ~/.cache/snowflake/