CVE-2025-50213
BaseFortify
Publication date: 2025-06-24
Last updated on: 2025-07-11
Assigner: Apache Software Foundation
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| apache | apache-airflow-providers-snowflake | to 6.4.0 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-75 | The product does not adequately filter user-controlled input for special elements with control implications. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability in Apache Airflow Providers Snowflake involves a failure to sanitize special elements, specifically semicolons, in parameters used by the CopyFromExternalStageToSnowflakeOperator. This lack of sanitization could allow an attacker to perform SQL injection or command chaining attacks by injecting malicious input into the operator's fields. [1]
How can this vulnerability impact me? :
If exploited, this vulnerability could allow an attacker to execute unauthorized SQL commands or chain commands within the Snowflake environment via Apache Airflow. This could lead to data breaches, unauthorized data manipulation, or other security compromises in systems using vulnerable versions of the provider. [1]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
You can detect this vulnerability by checking if your Apache Airflow Providers Snowflake version is before 6.4.0 and by inspecting usage of the CopyFromExternalStageToSnowflakeOperator for any parameters containing semicolons, which are disallowed in the fixed version. There are no specific commands provided to detect exploitation, but reviewing Airflow DAGs or logs for suspicious semicolon usage in table or stage parameters may help identify attempts. [1]
What immediate steps should I take to mitigate this vulnerability?
The immediate mitigation step is to upgrade Apache Airflow Providers Snowflake to version 6.4.0 or later, which includes input sanitization preventing semicolons in the CopyFromExternalStageToSnowflakeOperator parameters, thereby mitigating the SQL injection risk. [1]