Wiz researchers discovered a workflow injection vulnerability in Snowflake's snowflakedb/snowflake-connector-net repository on GitHub. The flaw exists in the `.github/workflows/jira_issue.yml` file, which processes GitHub issues without proper input validation.

An attacker can exploit this by crafting a malicious GitHub issue. When the workflow executes, it runs commands with access to internal Jira credentials stored in the environment. This allows command injection attacks that could compromise Snowflake's development infrastructure.

The vulnerability stems from unsafe handling of issue content in GitHub Actions workflows. Specifically, the workflow fails to sanitize user-controlled input before passing it to shell commands. An attacker with the ability to open issues in the public repository (either as a contributor or by exploiting the open-source nature of the project) can inject arbitrary shell commands.

The risk extends beyond Snowflake itself. Compromised Jira credentials could grant attackers access to internal issue tracking systems, project management data, and potentially other connected systems. The vulnerability also demonstrates a wider class of risks in CI/CD pipelines where user input intersects with privileged operations.

Snowflake developers commonly use the .NET connector, and malicious modifications injected through this vulnerability could theoretically affect downstream applications. However, successful exploitation requires the attacker's crafted issue to actually trigger the vulnerable workflow and for the payload to execute within the GitHub Actions runner environment.

Wiz coordinated disclosure with Snowflake, indicating the vulnerability has likely been patched. Organizations using this repository should verify they have the latest version and review their own GitHub Actions workflows for similar patterns. Specifically, any workflow that processes external input (issues, pull requests, comments) before executing commands with elevated permissions presents a target.

This incident underscores the need for defense-in-depth in CI/CD security