Homepage
About Snyk

Remote Code Execution (RCE) Affecting azure.identity package, versions [,1.10.2)

0.0
high

Snyk CVSS

    Attack Complexity Low
    Confidentiality High
    Integrity High
    Availability High

    Threat Intelligence

    EPSS 0.22% (60th percentile)
Expand this section
NVD
8.8 high

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk ID SNYK-DOTNET-AZUREIDENTITY-6009155
  • published 19 Oct 2023
  • disclosed 10 Oct 2023
  • credit Martin Wrona
Report a new vulnerability Found a mistake?

Introduced: 10 Oct 2023

CVE-2023-36414 Open this link in a new tab
CWE-94 Open this link in a new tab

How to fix?

Upgrade Azure.Identity to version 1.10.2 or higher.

Overview

Affected versions of this package are vulnerable to Remote Code Execution (RCE) by passing a specially crafted OS-level command to a specific SDK property which is passed to the underlying CLI.

By exploiting this vulnerability an attacker could gain high privileges, which include read, write, and delete functionality. The attacker needs to be authenticated as a normal user.

Note

The following credential types provided by the Azure Identity client library are affected:

  1. DefaultAzureCredential

  2. AzureCliCredential

  3. AzureDeveloperCliCredential

  4. AzurePowerShellCredential

References