Remote Code Execution (RCE) Affecting azure.identity package, versions [,1.10.2)
Threat Intelligence
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-DOTNET-AZUREIDENTITY-6009155
- published 19 Oct 2023
- disclosed 10 Oct 2023
- credit Martin Wrona
Introduced: 10 Oct 2023
CVE-2023-36414 Open this link in a new tabHow to fix?
Upgrade Azure.Identity to version 1.10.2 or higher.
Overview
Affected versions of this package are vulnerable to Remote Code Execution (RCE) by passing a specially crafted OS-level command to a specific SDK property which is passed to the underlying CLI.
By exploiting this vulnerability an attacker could gain high privileges, which include read, write, and delete functionality. The attacker needs to be authenticated as a normal user.
Note
The following credential types provided by the Azure Identity client library are affected:
DefaultAzureCredential
AzureCliCredential
AzureDeveloperCliCredential
AzurePowerShellCredential