🟠 High | Source: Microsoft Security Response Center
A vulnerability in rbash (restricted Bash shell) prior to version 4.4-beta2 allowed users to modify the BASH_CMDS array, effectively bypassing shell restrictions and executing arbitrary commands with the shell’s permissions. This matters because rbash is commonly used to confine users to a limited set of commands, and this flaw completely undermines that security boundary. Exploitation requires local shell access but can lead to full restriction bypass.
Security Architect’s Take: Audit any Azure-hosted Linux workloads, containers, or VM images that rely on rbash to restrict user activity, and ensure Bash is patched to 4.4-beta2 or later. Do not rely on rbash as a sole security control — pair it with additional access restrictions such as SELinux, AppArmor, or containerised environments with minimal capabilities.