Vulnerability · Published Oct 25, 2022 · Assigned by GitHub_M
CVE-2022-39327Improper Control of Generation of Code ('Code Injection') in Azure CLI
High 8.1
In plain English
A high-severity code injection in azure-cli from Azure. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 4.1% (higher than 91% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
Azure CLI is the command-line interface for Microsoft Azure. In versions previous to 2.40.0, Azure CLI contains a vulnerability for potential code injection. Critical scenarios are where a hosting machine runs an Azure CLI command where parameter values have been provided by an external source. The vulnerability is only applicable when the Azure CLI command is run on a Windows machine and with any version of PowerShell and when the parameter value contains the `&` or `|` symbols. If any of these prerequisites are not met, this vulnerability is not applicable. Users should upgrade to version 2.40.0 or greater to receive a a mitigation for the vulnerability.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| PyPI | azure-cli | 2.40.0 | GHSA-47xc-9rr2-q7p4 |
| PyPI | azure-cli | 2.40.0 | PYSEC-2022-43177 |
Affected products (as reported)
Weakness: CWE-94 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H