snowflake-labs-mcp

SQL injection vulnerability in list_objects function

In object_manager/tools.py lines 204-208, user input 'starts_with' is manually sanitized with only single-quote replacement, then directly interpolated into SQL: `statement += f" STARTS WITH '{sanitized_starts_with}'"`. This is insufficient - attackers can use backslashes or other SQL metacharacters to bypass the filter. The code even acknowledges bind variables aren't supported but proceeds with unsafe string formatting.

Arbitrary SQL execution without proper authorization

The run_query function in query_manager/tools.py executes any SQL statement passed to it. While there's middleware checking statement types (server_utils.py), the validation uses sqlglot parsing which can be bypassed with malformed SQL or comments. If parsing fails, it returns 'Unknown' which can be allowed via config. An attacker could craft SQL that parses incorrectly but still executes.

Path traversal vulnerability in file operations

In environment.py, the get_spcs_container_token() function reads from Path('/snowflake/session/token') but doesn't validate the path. While this specific path is hardcoded, the pattern suggests insufficient path validation elsewhere. Additionally, service configuration files are loaded from user-specified paths without validation against traversal attacks.

Secrets potentially logged in error messages

In utils.py (not provided but referenced), SnowflakeException is raised with raw error messages from APIs and SQL execution. In cortex_services/tools.py lines 82-86, response.text is directly included in exceptions, which may contain sensitive data. In query_manager/tools.py, raw exception messages are propagated.

Weak input validation on object creation

In object_manager/objects.py, the ObjectMetadata.parse_json_string validator accepts arbitrary JSON strings and parses them without schema validation first. An attacker could craft malicious JSON payloads that exploit deserialization vulnerabilities or pass unexpected data types to downstream operations.

Missing length limits on string inputs

Insufficient validation of database/schema/table names

Error messages expose internal implementation details