PT-2022-6012 · Microsoft · Azure Cli

Chasewilson · Published 2022-10-25 · Updated 2026-01-21 · CVE-2022-39327

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Azure CLI versions prior to 2.40.0

Description The vulnerability is related to the Azure CLI's command-line interface for Microsoft Azure, which contains a potential code injection issue in versions prior to 2.40.0. This vulnerability can be exploited when a hosting machine runs an Azure CLI command with parameter values provided by an external source. The vulnerability is only applicable when the Azure CLI command is run on a Windows machine and with any version of PowerShell, and when the parameter value contains the & or | symbols. Critical scenarios include hosting machines running Azure CLI commands with external input, such as web applications creating secrets in Azure KeyVault. For example, an attacker could inject system commands or scripts by providing a parameter value containing the & or | symbols.

Recommendations To resolve the issue, upgrade to Azure CLI version 2.40.0 or greater. Alternatively, for versions 2.41.0 and later, manually call the azps.ps1 entry script in identified critical scenarios, such as running the command C:Program Files (x86)Microsoft SDKsAzureCLI2wbinazps.ps1 keyvault secret set --vault-name SomeVault --name foobar --value "abc123|whoami". Note that using the azps.ps1 entry script may introduce regressions and issues in Azure CLI's behavior, and users should verify command effectiveness before use in production environments.

Exploit

Fix

Code Injection

OS Command Injection

Weakness Enumeration

CWE-94

CWE-78

Related Identifiers

BDU:2022-07463

BIT-AZURE-CLI-2022-39327

CVE-2022-39327

GHSA-47XC-9RR2-Q7P4

PYSEC-2022-43177

Affected Products

Azure Cli

References · 21

• 🔥 https://github.com/Azure/azure-cli/security/advisories/GHSA-47xc-9rr2-q7p4 · Exploit
• 🔥 https://github.com/Azure/azure-cli/pull/23514 · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/39xxx/CVE-2022-39327.json · Exploit
• https://github.com/Azure/azure-cli/pull/24015 · Patch
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-39327 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2022-43177 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-39327 · Security Note
• https://osv.dev/vulnerability/GHSA-47xc-9rr2-q7p4 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-azure-cli-2022-39327 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2022-39327 · Security Note
• https://osv.dev/vulnerability/CVE-2022-39327 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2022-39327 · Vendor Advisory
• https://ubuntu.com/security/CVE-2022-39327 · Vendor Advisory
• https://bdu.fstec.ru/vul/2022-07463 · Security Note
• https://github.com/Azure/azure-cli · Note