Snowflake GitHub Actions Workflow Injection Allows Command Execution via Crafted Issues
What Happened – Researchers at Wiz identified a workflow‑injection flaw in the public snowflakedb/snowflake-connector-net GitHub repository. A malicious GitHub issue can trigger the .github/workflows/jira_issue.yml workflow, causing arbitrary command execution that can harvest internal Jira credentials stored in the CI/CD pipeline.
Why It Matters for Compliance & Audit Readiness
- The scenario maps directly to SOC 2 CC6.1 (Change Management) and CC7.1 (System Operations) – controls that require documented, reviewed, and monitored changes to production pipelines.
- Continuous evidence of pipeline integrity is a core audit artifact; a mis‑configured workflow undermines the defensible audit trail that SOC 2 auditors expect.
- Verisq’s Control Mapping capability can automatically discover such CI/CD gaps, collect real‑time evidence, and feed it into your Trust Center for audit readiness.
Who Is Affected – SaaS and cloud‑native vendors that expose CI/CD pipelines or use third‑party GitHub Actions, especially data‑platform providers.
Recommended Actions
- Review all public and private GitHub Actions workflows for insecure triggers (e.g., issue‑based events).
- Harden CI/CD pipelines: restrict workflow triggers, enforce signed commits, and rotate any embedded service credentials.
- Map the workflow‑security controls to SOC 2 CC6.1/CC7.1 and capture continuous compliance evidence.
Source: The Hacker News
Technical Notes
- Attack vector: crafted GitHub issue → workflow injection → command execution.
- No public CVE assigned yet; the flaw resides in the
jira_issue.ymlworkflow file. - Potential exposure of internal Jira API tokens and other secrets.
Source: same as above