Mitigating PHP2Shell: Everything You Need to Know
Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| snowflake-sdk | npm | < 3.3.0 | 3.3.0 |
| snowflake-connector-python | pip | < 4.7.3 | 4.7.3 |
| github.com/snowflakedb/gosnowflake | go | <= 1.19.1 | |
| net.snowflake:snowflake-jdbc | maven | < 4.3.4 | 4.3.4 |
| net.snowflake:snowflake-jdbc-thin | maven | < 4.3.4 | 4.3.4 |
| net.snowflake:snowflake-jdbc-fips | maven | < 4.3.4 | 4.3.4 |
| github.com/snowflakedb/gosnowflake/v2 | go | < 2.2.0 | 2.2.0 |
Miggo AIRoot Cause AnalysisThe vulnerability CVE-2026-86597 describes sensitive information being written to diagnostic logs by Snowflake drivers. My analysis focused on the Node.js driver, specifically the snowflakedb/snowflake-connector-nodejs repository, as it was listed as the original repository and had a GHSA advisory.
I identified the patch by comparing the v3.2.0 (vulnerable) and v3.3.0 (patched) tags. The key commit, 'Logging hardening: correct SAS masking + extend cloud-URL query-param masking', directly addresses the issue.
The identified vulnerable functions are those that, in the vulnerable version, were responsible for logging sensitive data without proper redaction. These include:
GCSUtil.Logger().debug and RemoteStorageUtil.Logger().debug: These functions were logging full URLs, including potentially sensitive query strings (like pre-signed cloud-storage URLs), which could contain authentication tokens or encryption keys. The fix involved using a new stripQueryString utility to remove these sensitive parts before logging.SecretDetector.maskSecrets: This function's purpose is to redact sensitive information from logs. However, in the vulnerable version, it lacked the necessary regular expressions and masking logic to handle specific AWS SigV4 parameters (e.g., X-Amz-Credential, X-Amz-Security-Token) and S3 SSE-C customer keys. The patch added these missing redaction capabilities, making the function more comprehensive in its masking.LargeResultSetService.Logger.getInstance().debug and LargeResultSetService.Logger.getInstance().trace: These functions were logging entire HTTP response headers, which could contain sensitive values like session tokens or encryption keys. The patch modified these calls to use LoggingUtil.headerNames, ensuring only the names of the headers are logged, not their values.Exploitation would involve an attacker gaining read access to the diagnostic logs generated by the Snowflake Node.js driver. When the driver performs operations involving cloud storage interactions (e.g., downloading/uploading files, renewing pre-signed URLs) or processes HTTP responses, these vulnerable logging functions would inadvertently write sensitive credentials, tokens, or keys to the logs. An attacker could then retrieve these logs and use the exposed information to authenticate to Snowflake or cloud storage, bypassing security controls. The impact is bounded by the lifetime and scope of the exposed credentials.
GCSUtil.Logger().debuglib/file_transfer_agent/gcs_util.js
RemoteStorageUtil.Logger().debuglib/file_transfer_agent/remote_storage_util.js
SecretDetector.maskSecretslib/secret_detector.js
LargeResultSetService.Logger.getInstance().debuglib/services/large_result_set.js
LargeResultSetService.Logger.getInstance().tracelib/services/large_result_set.js