Frozen Privilege: Remote Code Execution in Snowflake-Managed PostgreSQL

A critical remote code execution (RCE) vulnerability was discovered in Snowflake-managed PostgreSQL by Varonis Threat Labs. This vulnerability demonstrates how trusted, managed cloud services can still contain hidden privilege chains that bypass customer-visible logging and undermine data integrity. The chain of vulnerabilities starts with a non-superuser role called snowflake_admin, which has the CREATEROLE attribute.

By utilizing this attribute, the attacker can self-grant predefined system roles, such as pg_read_all_data and pg_write_all_data, granting them read and write access across every table and system catalog in the cluster. The attacker then exploits the pg_cron feature, which executes SQL as any user with no password, to write a SECURITY DEFINER backdoor.

This backdoor allows the attacker to execute SQL as superuser by rewriting a job's username to "postgres." With superuser privileges, the attacker can rebuild blocked primitives using PostgreSQL's internal language and large objects, enabling arbitrary file read and write operations. Finally, the attacker overwrites the postgresql.auto.conf file to inject a shell command into archive_command, allowing them to achieve arbitrary command execution (RCE) as the postgres user.

This results in full OS-level RCE on the managed database, bypassing all published mitigations without disabling any of them.