{
  "document": {
    "acknowledgments": [
      {
        "names": [
          "\u003ca href=\"https://www.xing.com/profile/martin_wrona3\"\u003eMartin Wrona (martin_jw)\u003c/a\u003e with \u003ca href=\"https://www.galaxus.ch/\"\u003eDigitec Galaxus AG\u003c/a\u003e"
        ]
      }
    ],
    "aggregate_severity": {
      "namespace": "https://www.microsoft.com/en-us/msrc/security-update-severity-rating-system",
      "text": "Important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Public",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en-US",
    "notes": [
      {
        "category": "general",
        "text": "To determine the support lifecycle for your software, see the Microsoft Support Lifecycle: https://support.microsoft.com/lifecycle",
        "title": "Additional Resources"
      },
      {
        "category": "legal_disclaimer",
        "text": "The information provided in the Microsoft Knowledge Base is provided \\\"as is\\\" without warranty of any kind. Microsoft disclaims all warranties, either express or implied, including the warranties of merchantability and fitness for a particular purpose. In no event shall Microsoft Corporation or its suppliers be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages, even if Microsoft Corporation or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation may not apply.",
        "title": "Disclaimer"
      },
      {
        "category": "general",
        "text": "Required. The vulnerability documented by this CVE requires customer action to resolve.",
        "title": "Customer Action"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "secure@microsoft.com",
      "name": "Microsoft Security Response Center",
      "namespace": "https://msrc.microsoft.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "CVE-2023-36415 Azure Identity SDK Remote Code Execution Vulnerability - HTML",
        "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36415"
      },
      {
        "category": "self",
        "summary": "CVE-2023-36415 Azure Identity SDK Remote Code Execution Vulnerability - CSAF",
        "url": "https://msrc.microsoft.com/csaf/2023/msrc_cve-2023-36415.json"
      },
      {
        "category": "external",
        "summary": "Microsoft Exploitability Index",
        "url": "https://www.microsoft.com/en-us/msrc/exploitability-index?rtc=1"
      },
      {
        "category": "external",
        "summary": "Microsoft Support Lifecycle",
        "url": "https://support.microsoft.com/lifecycle"
      },
      {
        "category": "external",
        "summary": "Common Vulnerability Scoring System",
        "url": "https://www.first.org/cvss"
      }
    ],
    "title": "Azure Identity SDK Remote Code Execution Vulnerability",
    "tracking": {
      "current_release_date": "2023-10-13T07:00:00.000Z",
      "generator": {
        "date": "2025-01-01T02:10:24.873Z",
        "engine": {
          "name": "MSRC Generator",
          "version": "1.0"
        }
      },
      "id": "msrc_CVE-2023-36415",
      "initial_release_date": "2023-10-10T07:00:00.000Z",
      "revision_history": [
        {
          "date": "2023-10-10T07:00:00.000Z",
          "legacy_version": "1",
          "number": "1",
          "summary": "Information published."
        },
        {
          "date": "2023-10-13T07:00:00.000Z",
          "legacy_version": "1.1",
          "number": "2",
          "summary": "Added an FAQ. This is an information change only."
        }
      ],
      "status": "final",
      "version": "2"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "category": "product_version_range",
            "name": "\u003c1.10.2",
            "product": {
              "name": "Azure Identity SDK for Java \u003c1.10.2",
              "product_id": "2"
            }
          },
          {
            "category": "product_version",
            "name": "1.10.2",
            "product": {
              "name": "Azure Identity SDK for Java 1.10.2",
              "product_id": "12236"
            }
          }
        ],
        "category": "product_name",
        "name": "Azure Identity SDK for Java"
      },
      {
        "branches": [
          {
            "category": "product_version_range",
            "name": "\u003c1.14.1",
            "product": {
              "name": "Azure Identity SDK for Python \u003c1.14.1",
              "product_id": "1"
            }
          },
          {
            "category": "product_version",
            "name": "1.14.1",
            "product": {
              "name": "Azure Identity SDK for Python 1.14.1",
              "product_id": "12237"
            }
          }
        ],
        "category": "product_name",
        "name": "Azure Identity SDK for Python"
      },
      {
        "branches": [
          {
            "category": "product_version_range",
            "name": "\u003c1.10.2",
            "product": {
              "name": "Azure Identity SDK for .NET \u003c1.10.2",
              "product_id": "3"
            }
          },
          {
            "category": "product_version",
            "name": "1.10.2",
            "product": {
              "name": "Azure Identity SDK for .NET 1.10.2",
              "product_id": "12235"
            }
          }
        ],
        "category": "product_name",
        "name": "Azure Identity SDK for .NET"
      },
      {
        "branches": [
          {
            "category": "product_version_range",
            "name": "\u003c3.3.1",
            "product": {
              "name": "Azure Identity SDK for JavaScript \u003c3.3.1",
              "product_id": "4"
            }
          },
          {
            "category": "product_version",
            "name": "3.3.1",
            "product": {
              "name": "Azure Identity SDK for JavaScript 3.3.1",
              "product_id": "12234"
            }
          }
        ],
        "category": "product_name",
        "name": "Azure Identity SDK for JavaScript"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2023-36415",
      "cwe": {
        "id": "CWE-77",
        "name": "Improper Neutralization of Special Elements used in a Command (\u0027Command Injection\u0027)"
      },
      "notes": [
        {
          "category": "general",
          "text": "Microsoft",
          "title": "Assigning CNA"
        },
        {
          "category": "faq",
          "text": "An attacker who successfully exploited this vulnerability could gain high privileges, which include read, write, and delete functionality.",
          "title": "According to the CVSS metrics, successful exploitation of this vulnerability could lead to major loss of confidentiality (C:H), integrity (I:H), and availability (A:H). What does that mean for this vulnerability?"
        },
        {
          "category": "faq",
          "text": "The attacker for this vulnerability could target the server accounts in an arbitrary or remote code execution. As an authenticated user, the attacker could attempt to trigger malicious code in the context of the server\u0027s account through a network call.\nThe privilege requirement is low because the attacker needs to be authenticated as a normal user.",
          "title": "According to the CVSS metric, the attack vector is network (AV:N), and privilege required is low (PR:L). What is the target used in the context of the remote code execution?"
        },
        {
          "category": "faq",
          "text": "An attacker could exploit this vulnerability by passing a specially crafted OS-level command to a specific SDK property which is passed to the underlying CLI and results in remote code execution.",
          "title": "How could an attacker exploit this vulnerability?"
        },
        {
          "category": "faq",
          "text": "The vulnerability exists in the following credential types:\nDefaultAzureCredential\nAzureCliCredential\nAzureDeveloperCliCredential\nAzurePowerShellCredential",
          "title": "Which credential types provided by the Azure Identity client library are affected?"
        }
      ],
      "product_status": {
        "fixed": [
          "12234",
          "12235",
          "12236",
          "12237"
        ],
        "known_affected": [
          "1",
          "2",
          "3",
          "4"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2023-36415 Azure Identity SDK Remote Code Execution Vulnerability - HTML",
          "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36415"
        },
        {
          "category": "self",
          "summary": "CVE-2023-36415 Azure Identity SDK Remote Code Execution Vulnerability - CSAF",
          "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36415"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2023-10-10T07:00:00.000Z",
          "details": "1.10.2:Security Update:https://github.com/Azure/azure-sdk-for-java",
          "product_ids": [
            "2"
          ],
          "url": "https://github.com/Azure/azure-sdk-for-java"
        },
        {
          "category": "vendor_fix",
          "date": "2023-10-10T07:00:00.000Z",
          "details": "1.14.1:Security Update:https://github.com/Azure/azure-sdk-for-python",
          "product_ids": [
            "1"
          ],
          "url": "https://github.com/Azure/azure-sdk-for-python"
        },
        {
          "category": "vendor_fix",
          "date": "2023-10-10T07:00:00.000Z",
          "details": "1.10.2:Security Update:https://github.com/Azure/azure-sdk-for-net",
          "product_ids": [
            "3"
          ],
          "url": "https://github.com/Azure/azure-sdk-for-net"
        },
        {
          "category": "vendor_fix",
          "date": "2023-10-10T07:00:00.000Z",
          "details": "3.3.1:Security Update:https://github.com/Azure/azure-sdk-for-js",
          "product_ids": [
            "4"
          ],
          "url": "https://github.com/Azure/azure-sdk-for-js"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "environmentalsScore": 0.0,
            "exploitCodeMaturity": "UNPROVEN",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "remediationLevel": "OFFICIAL_FIX",
            "reportConfidence": "CONFIRMED",
            "scope": "UNCHANGED",
            "temporalScore": 7.7,
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C",
            "version": "3.1"
          },
          "products": [
            "1",
            "2",
            "3",
            "4"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Remote Code Execution"
        },
        {
          "category": "exploit_status",
          "details": "Exploited:No;Latest Software Release:Exploitation Less Likely"
        }
      ],
      "title": "Azure Identity SDK Remote Code Execution Vulnerability"
    }
  ]
}