Command Injection in Azure Service Connector and Azure CLI - CVE-2024-43591

Vulnerability identifier: #VU98200

CSH Severity: Low

CVSS v4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2024-43591

CWE-ID: CWE-77

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote user to execute arbitrary commands on the target system.

The vulnerability exists due to improper input validation in Azure Command Line Integration (CLI). A remote administrator can pass specially crafted data to the application and execute arbitrary commands on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Azure Service Connector
Azure CLI
SUSE Linux Enterprise High Performance Computing 15
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Manager Server
SUSE Manager Retail Branch Server
SUSE Manager Proxy
Public Cloud Module
openSUSE Leap
IBM Netezza Performance Server
azure-cli
azure-cli-test

Install updates from vendor's website.

IBM Netezza Performance Server - update to 11.2.3.3
azure-cli - update to 2.58.0-150400.14.12.1
azure-cli-test - update to 2.58.0-150400.14.12.1

• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2024-43591

• Command Injection in Microsoft Azure Command Line Integration (CLI)
• SUSE update for azure-cli
• Multiple vulnerabilities in IBM Netezza Performance Server