Most recent entries from all

bdu:2022-07463

certfr-2022-avi-1014 — De multiples vulnérabilités ont été corrigées dans Microsoft Azure. Elles permettent à un a…

certfr-2022-avi-1014

EUVD-2026-232586

fkie_cve-2022-39327

Azure CLI is the command-line interface for Microsoft Azure. In versions previous to 2.40.0, Azure CLI contains a vulnerability for potential code injection. Critical scenarios are where a hosting machine runs an Azure CLI command where parameter values have been provided by an external source. The vulnerability is only applicable when the Azure CLI command is run on a Windows machine and with any version of PowerShell and when the parameter value contains the `&` or `|` symbols. If any of these prerequisites are not met, this vulnerability is not applicable. Users should upgrade to version 2.40.0 or greater to receive a a mitigation for the vulnerability.

GHSA-47xc-9rr2-q7p4 — Improper Control of Generation of Code ('Code Injection') in Azure CLI

Affected: PyPI: azure-cli

# Description

In versions previous to 2.40.0, Azure CLI contains a vulnerability for potential code injection. Critical scenarios are where a hosting machine runs an Azure CLI command where parameter values have been provided by an external source.

For example: Application X is a web application with a feature that allows users to create Secrets in an Azure KeyVault. Instead of constructing API calls based on user input, Application X uses Azure CLI commands to create the secrets. Application X has input fields presented to the user and the Azure CLI command parameter values are filled based on the user input fields. This input, when formed correctly, could potentially be run as system commands. Below is an example of the resulting Azure CLI command run on the web app's hosting machine.

```bash az keyvault secret set --vault-name SomeVault --name foobar --value "abc123|whoami" ```

The above command could potentially run the `whoami` command on the hosting machine.

Interactive, in-terminal use and automation/pipeline scenarios have not been identified as critical risk scenarios.

## Code injection prerequisites

The vulnerability is only applicable when the Azure CLI command is run on a Windows machine **_and_** with any version of PowerShell **_and_**when the parameter value contains the `&` or `|` symbols. If any of these prerequisites are not met, this vulnerability is not applicable.

### 1. The command has to be run on Windows

The Azure CLI has an entry script th…

gsd-2022-39327

PYSEC-2022-43177

Affected: PyPI: azure-cli

UBUNTU-CVE-2022-39327

Affected: Ubuntu:20.04:LTS: azure-cli