CVE-2023-36052

FAQ

What type of information could be disclosed by this vulnerability?

An attacker that successfully exploited this vulnerability could recover plaintext passwords and usernames from log files created by the affected CLI commands and published by Azure DevOps and/or GitHub Actions.

According to the CVSS metric, a successful exploitation could lead to a scope change (S:C). What does this mean for this vulnerability?

An exploited vulnerability can affect resources beyond the security scope managed by the security authority of the vulnerable component. In this case, the vulnerable component and the impacted component are different and managed by different security authorities.

How could an attacker exploit this vulnerability?

An unauthenticated attacker can search and discover credentials contained in log files which have been stored in open-source repositories.

Where can I find more information?

Please see the MSRC Blog Post relating to this vulnerability here: Microsoft guidance regarding credentials leaked to Github Actions logs through Azure CLI.

What actions do customers need to take to protect themselves from this vulnerability?

Customers using the affected CLI commands must update their Azure CLI version to 2.53.1 or above to be protected against the risks of this vulnerability. This also applies to customers with log files created by using these commands through Azure DevOps and/or GitHub Actions.