CVE-2022-39327highCWE-94

CVE-2022-39327: high-severity vulnerability in azure-cli

Improper Control of Generation of Code ('Code Injection') in Azure CLI

Published · Updated

Follow this CVE+ Monitor azure-cli+ Monitor azure-cli

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

21Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 8.1epss 4.1%
In short

Azure CLI on Windows allows attackers to inject and execute arbitrary code through command parameters containing special characters like & or |. This happens when external sources provide parameter values to Azure CLI commands, potentially compromising the entire system.

Technical detail

Code injection vulnerability in Azure CLI versions before 2.40.0 on Windows systems; attack vector requires unsanitized parameter input containing & or | symbols passed to CLI commands, typically from external sources. Exploitation occurs during command parsing in PowerShell context, allowing arbitrary code execution with privileges of the CLI process.

Summary generated and translated by AI from the official description.
Azure CLI is the command-line interface for Microsoft Azure. In versions previous to 2.40.0, Azure CLI contains a vulnerability for potential code injection. Critical scenarios are where a hosting machine runs an Azure CLI command where parameter values have been provided by an external source. The vulnerability is only applicable when the Azure CLI command is run on a Windows machine and with any version of PowerShell and when the parameter value contains the `&` or `|` symbols. If any of these prerequisites are not met, this vulnerability is not applicable. Users should upgrade to version 2.40.0 or greater to receive a a mitigation for the vulnerability.
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected products
Azure · azure-cli