Description
pbi-cli 3.10.1 through 3.12.0 contains an OS command injection vulnerability in desktop_sync.py that passes unquoted .pbip paths to cmd /c start when reopening projects. Attackers can lure victims into opening a Power BI project from a space-free path containing & to run commands with victim privileges during report write or reload.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
MinaSaad1 pbi-cli
Default version status: unaffected
3.10.1 to ≤ 3.12.0affected
pkg:pypi/pbi-cli-toolReferences
- https://hackmd.io/@haind/pbi-cli-desktop-sync-pbip-cmd-argument-injection ↗
- https://github.com/MinaSaad1/pbi-cli/blob/c8655cb9a131e2ce87ae5e1380994099f693d6af/src/pbi_cli/utils/desktop_sync.py#L398-L405 ↗
- https://github.com/MinaSaad1/pbi-cli/blob/c8655cb9a131e2ce87ae5e1380994099f693d6af/src/pbi_cli/utils/desktop_sync.py#L286-L291 ↗
- https://github.com/MinaSaad1/pbi-cli ↗
- https://www.vulncheck.com/advisories/pbi-cli-3.10.1-through-3.12.0-os-command-injection-via-desktop-sync ↗