Frozen Privilege: Remote Code Execution in Snowflake-Managed PostgreSQL

This story was originally published on HackerNoon at: https://hackernoon.com/frozen-privilege-remote-code-execution-in-snowflake-managed-postgresql.
Varonis uncovered an RCE chain in Snowflake-managed PostgreSQL, showing how database privileges and legitimate features could lead to OS-level access.
Check more stories related to undefined at: https://hackernoon.com/c/undefined. You can also check exclusive content about #cloud-database-security, #varonis-threat-labs, #pg_cron-privilege-escalation, #postgresql-security, #postgresql-vulnerability, #managed-database-security, #privilege-escalation, #good-company, and more.

This story was written by: @varonis. Learn more about this writer by checking @varonis's about page, and for more stories, please visit hackernoon.com.

Varonis Threat Labs discovered a remote code execution vulnerability in Snowflake-managed PostgreSQL by chaining legitimate PostgreSQL features and privileges. A non-superuser role with CREATEROLE could escalate privileges through predefined system roles and pg_cron, then reconstruct blocked file-access functions and use archive_command to execute OS commands. Snowflake remediated the issue server-side, and customers do not need to take action. The research highlights broader risks involving privilege escalation, managed database trust boundaries, and activity that bypasses normal SQL audit trails.