Product:
Azure Container Apps
Summary
Improper control of code generation in Azure Container Apps allows an unauthorized attacker to execute code over a network. This vulnerability poses a significant risk as it can lead to unauthorized access and manipulation of sensitive data. The potential impact includes high confidentiality, integrity, and availability risks.
Details
| Severity | Base Score | CVE |
|---|---|---|
| CRITICAL | 10 | CVE-2025-65037 |
Exploitation
An attacker can exploit this vulnerability by sending specially crafted requests to Azure Container Apps, which can lead to code injection. Since the attack complexity is low and does not require any privileges or user interaction, it makes the exploitation straightforward for unauthorized users. Once the code is injected, the attacker can execute arbitrary code within the application context.
Affected Products
- Azure Container Apps: Vulnerable to code injection attacks that allow unauthorized code execution over the network.
Mitigation
To mitigate this vulnerability, it is essential to apply the latest security updates provided by Microsoft. Additionally, implementing strict input validation and monitoring network traffic can help prevent unauthorized code execution. Regular security assessments and audits should also be conducted to identify and address potential vulnerabilities.