T05 · Unauthorized Access and Privilege Escalation
Error
- Location
- SKILL.md:12
- Finding
- Administrative Snowflake Role Exposed Through Arbitrary SQL Execution## Vulnerability Details **File Location**: `SKILL.md:12-34`, `SKILL.md:77-86`; `mcp-server-examples.sql:8-16` **Vulnerability Type**: Excessive privileges and unrestricted SQL execution **Risk Level**: High ### Vulnerable Code `SKILL.md:12-16`: ```markdown ### Prerequisites - Snowflake account with ACCOUNTADMIN role - Programmatic Access Token (PAT) from Snowflake - Clawdbot or any MCP-compatible client ``` `SKILL.md:25-34`: ```sql CREATE OR REPLACE MCP SERVER my_mcp_server FROM SPECIFICATION $$ tools: - name: "SQL Execution Tool" type: "SYSTEM_EXECUTE_SQL" description: "Execute SQL queries against the Snowflake database." title: "SQL Execution Tool" $$; ``` `SKILL.md:77-86`: ```sql CREATE OR REPLACE MCP SERVER sql_mcp_server FROM SPECIFICATION $$ tools: - name: "SQL Execution Tool" type: "SYSTEM_EXECUTE_SQL" description: "Execute SQL queries against Snowflake." title: "SQL Execution" $$; ``` `mcp-server-examples.sql:8-16`: ```sql CREATE OR REPLACE MCP SERVER basic_mcp_server FROM SPECIFICATION $$ tools: - name: "SQL Execution Tool" type: "SYSTEM_EXECUTE_SQL" description: "Execute SQL queries against the Snowflake database." title: "SQL Execution" $$; ``` ### Technical Analysis The setup names `ACCOUNTADMIN` as a prerequisite and exposes `SYSTEM_EXECUTE_SQL` to an MCP-connected AI client. `ACCOUNTADMIN` is Snowflake's highest-level administrative role and exceeds the permissions normally required for querying a defined dataset or invoking a narrowly scoped Cortex service. The managed-server examples do not impose statement-level restrictions on the SQL tool. Effective access therefore depends on the role associated with the PAT and Snowflake RBAC. If the PAT is created for an administrative or otherwise broad role, tool calls may execute SQL with those broad permissions. This creates a dangerous privilege bounda ...[truncated 1491 chars]
- Remediation
- ## Remediation Suggestions 1. Remove `ACCOUNTADMIN` from the prerequisites. Create a dedicated MCP service role with only the privileges required by the intended tools. 2. Grant access only to explicitly required databases, schemas, tables, views, warehouses, Cortex services, functions, and procedures. 3. Do not expose `SYSTEM_EXECUTE_SQL` when a Cortex Search, Analyst, Agent, or narrowly scoped stored procedure can satisfy the use case. 4. Where SQL execution is necessary, default to read-only statements and explicitly reject DDL, DML, privilege-management commands, procedure calls, and unrecognized statement types. 5. Use secure views, row-access policies, masking policies, and network policies to constrain data exposure. 6. Create short-lived, dedicated credentials for the MCP service rather than reusing administrator credentials. 7. Require explicit human approval for destructive, administrative, or high-cost operations. 8. Enable Snowflake query auditing and alert on privilege changes, bulk exports, destructive statements, and unusual query volume.