Executive brief
Azure ms-rest-nodeauth is a Node.js authentication library used by Azure SDK clients to handle credential management and authorization. An improper privilege management flaw allows an attacker with local access and user interaction to gain elevated privileges, potentially compromising the confidentiality and integrity of applications using this library.
Technical details
This vulnerability in Azure ms-rest-nodeauth (version ≤3.0.7) is a command injection / improper privilege management issue (CWE-269) that stems from unsafe handling of user-controlled input in authentication flows. The vulnerability requires local access and user interaction (CVSS vector: AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H). An attacker can exploit this to execute arbitrary code with elevated privileges in the context of the affected application. The fix was released in version 3.0.8 with a commit addressing command injection in the login authentication path.
Affected products
- Microsoft ms-rest-nodeauth <=3.0.7
Timeline
- 2021-04-13: disclosed
- 2022-05-24: patched: Fix released in version 3.0.8