Their investigation revealed that the service operates under “owners’ rights” rather than “callers’ rights,” potentially allowing lower-privileged users to access sensitive data that should remain masked according to established security policies. Snowflake’s CORTEX Search Service, a cutting-edge AI-driven search and retrieval tool, promises to revolutionize how organizations interact with their data through natural language queries and enhanced retrieval capabilities. While this policy correctly masks sensitive data when queried directly, CORTEX Search bypasses this protection by executing queries under its service role’s elevated privileges. However, CORTEX Search employs “owners’ rights,” meaning it executes with the privileges of the role that created the service, regardless of who initiates the query. Cyera researchers identified a critical security gap in how CORTEX Search interacts with Snowflake’s dynamic data masking policies. Besides this, a regular user with only USAGE permission on the CORTEX Search Service can retrieve unmasked data that would otherwise be hidden from them. Users only need USAGE permissions on the service to query data through CORTEX Search. Designed to simplify complex data operations, this service allows users to perform fuzzy searches and leverage large language model capabilities without requiring direct SELECT privileges on underlying tables. Organizations implementing dynamic data masking to protect sensitive information from unauthorized viewing may unknowingly expose that same data through CORTEX Search. When an administrator deploys CORTEX Search Service using a privileged role such as ACCOUNTADMIN, the service inherits all the access permissions of that role. Subsequently, any user granted USAGE on the service can leverage these borrowed privileges to retrieve data they would normally not have permission to view in plaintext form. In systems operating under “callers’ rights,” processes execute with the same permissions as the invoking user, maintaining security boundaries. However, as AI integration deepens in data analytics platforms, a concerning pattern emerges where advanced functionality may inadvertently undermine carefully established security controls.
This Cyber News was published on cybersecuritynews.com. Publication date: Tue, 06 May 2025 21:10:48 +0000