Improper neutralization of special elements used in a command ('command injection') in Azure Compute Gallery allows an authorized attacker to elevate privileges locally.
What privileges could be gained by an attacker who successfully exploited the vulnerability? An attacker who exploited this vulnerability could execute arbitrary commands within the affected ACI container’s context, allowing them to run code with the same privileges as the compromised container. In confidential‑container scenarios, this could also let an attacker access sensitive secrets or data protected by the attested environment.
<a href="https://x.com/yuvalavra">Yuval Avrahami</a>