CVE-2024-8055

Vanna 0.6.3 SQL injection allows reading arbitrary local files via Snowflake database.

• CVSS 7.5
• CWE-89
• Input Validation and Sanitization
• Remote

Vanna v0.6.3 is vulnerable to SQL injection via Snowflake database in its file staging operations using the `PUT` and `COPY` commands. This vulnerability allows unauthenticated remote users to read arbitrary local files on the victim server, such as `/etc/passwd`, by exploiting the exposed SQL queries through a Python Flask API.

CVE

CVE-2024-8055

CWE

CWE-89

CVSS base score

7.5

Published

2025-03-20

OWASP

A03 Injection

Orthogonal defect classification

Interface

Code defect classification

Incorrect Functionality

Category

Input Validation and Sanitization

Subcategory

SQL Injection

Accessibility scope

Remote

Impact

Data Theft

Affected component

Vanna

Fixed by upgrading

Yes

Solution

Upgrade to Vanna v0.6.4 or later.

import sqlite3

def get_user(user_id):
    """Get user - VULNERABLE to SQL injection"""
    conn = sqlite3.connect('users.db')
    cursor = conn.cursor()
    
    # VULNERABILITY: String concatenation in SQL
    query = f"SELECT * FROM users WHERE id = {user_id}"
    cursor.execute(query)
    
    result = cursor.fetchone()
    conn.close()
    return result

# Example exploitation:
# get_user("1 OR 1=1 --")

import sqlite3

def get_user_secure(user_id):
    """Securely get user with parameterized query"""
    try:
        if not isinstance(user_id, int) or user_id <= 0:
            return None
        
        conn = sqlite3.connect('users.db')
        cursor = conn.cursor()
        
        # SECURE: Parameterized query
        query = "SELECT * FROM users WHERE id = ?"
        cursor.execute(query, (user_id,))
        
        result = cursor.fetchone()
        conn.close()
        return result
    except Exception:
        return None

;PUT file:///etc/passwd @%users; COPY INTO users FROM @%users;

@misc{vaitp:cve20248055,
  title        = {{Vanna 0.6.3 SQL injection allows reading arbitrary local files via Snowflake database.
}},
  author       = {Bogaerts, Fr\'ed\'eric and Ivaki, Naghmeh and Fonseca, Jos\'e},
  year         = {2025},
  note         = {VAITP Python Vulnerability Dataset, entry CVE-2024-8055},
  howpublished = {\url{https://netpack.pt/vaitp/vulnerability/CVE-2024-8055/}}
}