FROZEN PRIVILEGE: REMOTE CODE EXECUTION IN SNOWFLAKE-MANAGED POSTGRESQL

Summary from the TLDR InfoSec newsletter

Varonis researchers found that Snowflake-managed PostgreSQL's non-superuser snowflake_admin role could be escalated to OS-level RCE by chaining five documented PostgreSQL features, defeating every published mitigation without disabling any. The chain used CREATEROLE to self-grant pg_write_all_data and hijacked a pg_cron job to run as postgres. It then rebound blocked functions through LANGUAGE internal, exposing tenant mTLS keys and AWS STS credentials and allowing an overwrite of archive_command. Snowflake has fixed the issue server-side, but teams running their own PostgreSQL should treat CREATEROLE as near-superuser, block LANGUAGE internal and C function creation, and audit pg_cron jobs and SECURITY DEFINER functions.