Improper neutralization of special elements used in a command ('command injection') in Azure Command Line Integration (CLI) allows an unauthorized attacker to elevate privileges locally.
What privileges could be gained by an attacker who successfully exploited the vulnerability? The attacker would gain the rights of the user that is running the affected application. How could an attacker exploit this vulnerability? An attacker could exploit this vulnerability by passing a specially crafted key-value argument to Azure CLI, injecting arbitrary Python code that modifies runtime behavior.
<a href="https://jackfromeast.github.io/">Zhengyu Liu</a> and <a href="https://www.linkedin.com/in/gavin-zhong/">Jiacheng(Gavin) Zhong</a> with <a href="https://isi.jhu.edu/">Johns Hopkins University</a>, <a href="https://jackfromeast.github.io/">Zhengyu Liu</a> with <a href="https://www.cs.jhu.edu/">Johns Hopkins University</a>, <a href="https://www.linkedin.com/in/gavin-zhong/">Jiacheng(Gavin) Zhong</a> with <a href="https://isi.jhu.edu/">Johns Hopkins University</a>