Full Report
Don't worry, this one was via a bug bounty program
Analysis Summary
# Vulnerability: AI-Generated GitHub Actions Command Injection in Snowflake-Connector-Net
## CVE Details
- **CVE ID**: Not explicitly assigned in the report (Referenced via Snowflake/Wiz private disclosure).
- **CVSS Score**: Estimated 8.8 - 9.8 (Critical)
- **CWE**: CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
## Affected Systems
- **Products**: snowflake-connector-net (Official Snowflake .NET Driver)
- **Versions**: Commits between June 18, 2026, and June 23, 2026.
- **Configurations**: GitHub Actions workflows using `run:` blocks with direct string expansion of untrusted inputs (specifically `${{ github.event.issue.title }}`).
## Vulnerability Description
The flaw was a script injection vulnerability within a GitHub Actions CI/CD workflow. It was inadvertently introduced by **GitHub Copilot Autofix**, which removed a sanitized input pattern and replaced it with direct string expansion in a shell script.
When a GitHub issue was opened, the workflow would echo the issue title. Because the title was not sanitized, an attacker could use shell metacharacters (e.g., backticks or `$()`) to break out of the intended command and execute arbitrary code within the context of the GitHub Actions runner.
## Exploitation
- **Status**: PoC available (Verified by Wiz "Red Agent" AI).
- **Complexity**: Low (Autonomous AI agents successfully discovered and exploited it).
- **Attack Vector**: Network (Unauthenticated; triggered by opening a GitHub issue).
## Impact
- **Confidentiality**: High (Ability to exfiltrate secrets and environment variables).
- **Integrity**: High (Potential to modify build artifacts or source code).
- **Availability**: Medium (Potential to disrupt CI/CD pipelines).
- **Specific Incident Outcome**: Wiz successfully exfiltrated Jira credentials providing read access to Snowflake’s engineering, security, and bug bounty projects.
## Remediation
### Patches
- **Snowflake**: The vulnerability was patched on June 23, 2026, by reverting the AI-generated code to a secure input-sanitization pattern.
- **Credential Rotation**: All affected Jira tokens were revoked and rotated on June 24, 2026.
### Workarounds
- Implement "Restrictive GitHub Actions" permissions (e.g., `contents: read`).
- Avoid using `github.event.issue.title` or `github.event.issue.body` directly in `run` steps. Instead, use environment variables to handle the data safely.
## Detection
- **Indicators of Compromise**: Audit logs showing unusual "Out-of-band" (OOB) callbacks from GitHub Actions runners; unauthorized access to Jira endpoints via CI/CD-sourced tokens.
- **Detection Methods**:
- Static Analysis Security Testing (SAST) specifically targeting GitHub Actions YAML files.
- Reviewing all commits co-authored by AI assistants (e.g., GitHub Copilot).
- Monitoring GitHub audit logs for issue titles containing shell metacharacters.
## References
- **Wiz Blog**: hxxps[://]www[.]wiz[.]io/blog/red-agent-snowflake-copilot-cicd-bug
- **Affected Repository**: hxxps[://]github[.]com/snowflakedb/snowflake-connector-net/pull/1218
- **Vendor**: hxxps[://]www[.]snowflake[.]com/