pbi-cli 3.10.1 through 3.12.0 contains an OS command injection vulnerability in desktop_sync.py that passes unquoted .pbip paths to cmd /c start when reopening projects. Attackers can lure victims into opening a Power BI project from a space-free path containing & to run commands with victim privileges during report write or reload.
Attack Parameters
Attack Vector
Local
Requires local access
Attack Complexity
Low
Easy to exploit
Attack Requirements
Present
Additional conditions required
Privileges Required
None
No privileges needed
User Interaction
Passive
Minimal interaction
Impact Assessment
Confidentiality
High
Complete data leak
Integrity
High
Complete data modification
Availability
High
Complete denial of service
CVSS Vector v4.0
Weakness Type (CWE)
References 5
https://github.com/MinaSaad1/pbi-cli
disclosure@vulncheck.com
https://github.com/MinaSaad1/pbi-cli/blob/c8655cb9a131e2ce87ae5e1380994099f693d…
disclosure@vulncheck.com
https://github.com/MinaSaad1/pbi-cli/blob/c8655cb9a131e2ce87ae5e1380994099f693d…
disclosure@vulncheck.com
https://hackmd.io/@haind/pbi-cli-desktop-sync-pbip-cmd-argument-injection
disclosure@vulncheck.com
https://www.vulncheck.com/advisories/pbi-cli-3.10.1-through-3.12.0-os-command-i…
disclosure@vulncheck.com