🟠 High  |  Source: Microsoft Security Response Center


A vulnerability in rbash (restricted Bash shell) prior to version 4.4-beta2 allowed users to modify the BASH_CMDS array, effectively bypassing shell restrictions and executing arbitrary commands with the shell’s permissions. This matters because rbash is commonly used to confine users to a limited set of commands, and this flaw completely undermines that security boundary. Exploitation requires local shell access but can lead to full restriction bypass.

Security Architect’s Take: Audit any Azure-hosted Linux workloads, containers, or VM images that rely on rbash to restrict user activity, and ensure Bash is patched to 4.4-beta2 or later. Do not rely on rbash as a sole security control — pair it with additional access restrictions such as SELinux, AppArmor, or containerised environments with minimal capabilities.

Original advisory: CVE-2019-9924 rbash in Bash before 4.4-beta2 did not prevent the shell user from modifying BASH_CMDS, thus allowing the user to execute any command with the permissions of the shell.