Snowflakeの脆弱性をCopilotが見逃し、5日後には悪用を実証

"Crucially, the vulnerability became live on June 18, 2026 - just five days before its discovery - when PR #1218 was merged."（Executive Summary）／"June 23, 2026 - Wiz identified, exploited, and reported vulnerability to Snowflake via HackerOne (report #3819931)"／"June 24, 2026 - Jira token rotated"（いずれも Disclosure Timeline）— Wiz 公式ブログより

"The exfiltrated token authenticated as qa@snowflake.net to snowflakecomputing.atlassian.net, granting read access across Snowflake's engineering, security compliance, and bug bounty tracking projects."（Exploitation）／"Comprehensive audit log analysis confirmed that no external third parties accessed the endpoint during the 5-day exposure window. All anomalous queries were strictly matched to Wiz's testing IPs."（Remediation & Forensics）／"our investigation found no evidence of unauthorized access"（Snowflake's Response）／"Wiz confirmed that all data accessed during proof-of-concept testing was securely deleted."（記事冒頭）— Wiz 公式ブログより

"The workflow triggered on issues: opened - meaning any GitHub user could fire it by opening an issue - and interpolated the attacker-controlled issue title directly into a shell script"／"The sed escaping runs after GitHub's template expansion, a single quote in the title breaks out of echo '...' and allows arbitrary command execution."／"The merged PR removed the repository’s existing safe env: and jq pattern and replaced it with direct ${{ github.event.issue.title }} interpolation, creating the injection vector."／"Copilot Autofix’s documented contribution was a separate fix to jira_close.yml within the same PR."（いずれも The Code Change）— Wiz 公式ブログより

"However, on issues events, github.event.pull_request is always null. So the condition reduces to (null != 'whitesource-for-github-com[bot]'). This is always true, and every GitHub user passes the gate."（The Open "Security Gate"）— Wiz 公式ブログより

"August 17, 2026, 1957 UTC update: This blog has been updated to clarify that Copilot was a co-author that checked the merged PR and code change, and identified it as all-clear without noticing the critical vulnerabilities. It's unclear whether the code-change was AI-assisted."（記事冒頭の更新注記）／"GitHub Advanced Security scan analyzed the final PR revision, including the vulnerable workflow, but did not flag the critical injection."（Executive Summary）— Wiz 公式ブログより

"Rather than stopping or failing, Red Agent:"／"autonomously analyzed the syntax execution error"／"adjusted its payload to use ; echo ' to properly close the shell block, and"／"successfully received the out-of-band callback"（Exploitation・原文の箇条書きを ／ で連結）— Wiz 公式ブログより

"AI coding tools predict code based on probabilistic patterns, which can inadvertently reintroduce deprecated or insecure shell patterns. AI-generated PRs must undergo the same static analysis and security scrutiny as human code."（Key Takeaways / AI Code Generation Demands Rigorous Oversight）／"Security intent can be lost when safer code patterns are not explicitly enforced. In this incident, the merged PR removed a safe env: + jq parsing pattern and replaced it with direct string interpolation, while the existing security solution failed to flag the resulting injection that led to the exposure."（Key Takeaways / Preventing CI/CD Security Regressions）— Wiz 公式ブログより

"The vulnerability was live for only five days before an automated agent discovered and validated it. Security operations must adapt to a landscape where automated discovery occurs in hours, requiring rapid patch cycles and short-lived credentials."（Key Takeaways / Collapsing Discovery Windows）／"Same-Day Patching: Snowflake patched the workflow on June 23, 2026 (1dc7766, PR #1402), fully restoring the safe env: variable and jq --arg parsing pattern."／"Credential Revocation: The JIRA token in question was revoked and rotated."（いずれも Remediation & Forensics）— Wiz 公式ブログより