CVE-2025-46329

Executive Summary

CVE-2025-46329 is a local information disclosure vulnerability in the Snowflake Connector for C/C++ (libsnowflakeclient). Versions 0.5.0 through 2.1.x (prior to 2.2.0) are affected. When the logging level is set to DEBUG, the connector logs the client-side encryption master key of the target stage to local log files during the execution of GET and PUT commands. While this key alone does not grant access to sensitive data without additional authorizations, it represents a significant security concern for local log hygiene and compliance. The vulnerability has been patched in version 2.2.0.

Supply Chain & Package Security

This vulnerability affects the libsnowflakeclient library, which is distributed as a C/C++ library. Users should verify they are using version 2.2.0 or later. The library is typically integrated into applications via package managers or direct source compilation. No known supply chain compromise has been reported.

CVSS Breakdown & Threat Level

• CVSS Score: 3.3 (Low)
• Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
• Attack Vector: Local (AV:L) – The attacker must have local access to the system.
• Attack Complexity: Low (AC:L) – No special conditions are required.
• Privileges Required: Low (PR:L) – The attacker needs local user privileges.
• User Interaction: None (UI:N) – No user action is required.
• Scope: Unchanged (S:U) – The vulnerability does not affect other components.
• Confidentiality Impact: Low (C:L) – Limited disclosure of a key that does not directly grant data access.
• Integrity Impact: None (I:N)
• Availability Impact: None (A:N)

Threat Level: Low. Exploitation requires local access and DEBUG-level logging. The exposed key is not sufficient for direct data access.

Deep Dive & Mechanics

The vulnerability resides in the logging mechanism of libsnowflakeclient. During the execution of GET and PUT commands, the library handles client-side encryption master keys for stages. When the logging level is set to DEBUG, the library logs the key value to local log files without redaction. This occurs because the logging function directly includes the key parameter in the log message.

The key is used for client-side encryption of data staged in Snowflake. While the key itself does not grant access to data without additional authorizations (e.g., access to the stage and the encrypted data), its exposure in logs can be leveraged by an attacker with local access to the system to potentially decrypt data if they also obtain the encrypted data and other required credentials.

The fix in version 2.2.0 involves redacting the key from log messages, ensuring that sensitive information is not written to logs.

Vulnerable vs. Patched Code

Vulnerable Code (simplified example):

// In vulnerable version (e.g., 2.1.x)
void log_debug(const char* format, ...) {
    // ... logging logic
    // Directly logs the key
    sf_log_debug("Client-side encryption master key: %s", stage_key);
}

Patched Code (version 2.2.0):

// In patched version (2.2.0)
void log_debug(const char* format, ...) {
    // ... logging logic
    // Redact the key
    sf_log_debug("Client-side encryption master key: [REDACTED]");
}

The patched version replaces the actual key value with a placeholder string [REDACTED] in log output.

Exploitation & Lab Setup

Red Team

Prerequisites:

• Local access to a system running a vulnerable version of libsnowflakeclient (0.5.0 to 2.1.x).
• The application using the library must have logging level set to DEBUG.
• The application must execute GET or PUT commands on a stage with client-side encryption enabled.

Exploitation Steps:

1. Gain local access to the target system (e.g., via SSH, RDP, or physical access).
2. Locate the log files generated by the application using libsnowflakeclient. Common locations include /var/log/, ~/.snowflake/, or application-specific directories.
3. Search for log entries containing the string "client-side encryption master key".
4. Extract the key value from the log entry.
5. If the attacker also has access to the encrypted data (e.g., from the stage) and the necessary credentials, they can use the key to decrypt the data.

Example log entry (vulnerable):

2025-03-15 10:30:45 DEBUG [libsnowflakeclient] Client-side encryption master key: AQIDBAUGBwgJCgsMDQ4PEBESExQVFhcYGRobHB0eHyA=

Blue Team

Detection:

• Monitor for log entries containing the string "client-side encryption master key" followed by a base64-encoded value.
• Alert on any occurrence of this pattern in application logs.

Response:

• Immediately rotate the exposed encryption master key.
• Review access logs to determine if unauthorized users accessed the log files.
• Upgrade to libsnowflakeclient version 2.2.0 or later.
• Ensure logging level is set to INFO or higher in production environments.

Prevention:

• Implement log redaction for sensitive data.
• Use centralized logging with access controls.
• Regularly audit log files for sensitive information exposure.

Indicators of Compromise (IOCs)

• Log Pattern: Client-side encryption master key: [A-Za-z0-9+/=]{20,} (base64-encoded key)
• File Paths: Application log files containing DEBUG-level messages from libsnowflakeclient.
• Process: Any process using libsnowflakeclient version < 2.2.0 with DEBUG logging enabled.

Detection Engineering

YARA Rule

rule CVE_2025_46329_Snowflake_Key_Leak {
    meta:
        description = "Detects Snowflake client-side encryption master key in log files"
        author = "Valters IT"
        date = "2025-03-15"
        reference = "CVE-2025-46329"
        severity = "low"
    strings:
        $key_prefix = "Client-side encryption master key: "
        $base64_pattern = /[A-Za-z0-9+\/=]{20,}/
    condition:
        $key_prefix and $base64_pattern
}

Sigma Rule

title: Snowflake Client-Side Encryption Key Leak in Logs
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects exposure of Snowflake client-side encryption master key in log files
author: Valters IT
date: 2025/03/15
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2025-46329
logsource:
    category: application
    product: libsnowflakeclient
detection:
    selection:
        EventID: 1
        Message|contains: "Client-side encryption master key: "
    condition: selection
falsepositives:
    - Legitimate debugging sessions (should be rare)
level: low

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2025-46329 Snowflake Client-Side Encryption Key Leak"; flow:to_server,established; content:"Client-side encryption master key: "; pcre:"/[A-Za-z0-9+\/=]{20,}/"; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade libsnowflakeclient to version 2.2.0 or later.
2. If upgrade is not immediately possible, set the logging level to INFO or higher to prevent DEBUG messages from being written.
3. Rotate any encryption master keys that may have been exposed in logs.

Long-Term Measures:

• Implement log redaction for all sensitive data (keys, passwords, tokens).
• Use a centralized logging solution with access controls and audit trails.
• Regularly review and audit log files for sensitive information exposure.
• Follow the principle of least privilege for log file access.

Valters IT Signature

This report was generated by Valters IT DevSecOps & CTI Expert System.