Yast2 Auth Client
Monthly
OS command injection in SUSE's yast2-auth-client allows an attacker who controls Active Directory configuration values to execute arbitrary commands as root on the target Linux host. The vulnerable code in Auth::AuthConf (src/lib/auth/authconf.rb) constructs Samba net ads join, net ads lookup -S, and net ads testjoin command strings by directly interpolating OU, dnshostname, AD username, and AD domain name values without validation or shell-quoting, then passes the assembled string to Ruby's Open3.popen2 or Open3.capture2, which delegates to /bin/sh. No public exploit has been identified at time of analysis and the vulnerability is not listed in the CISA KEV catalog.
OS command injection in SUSE's yast2-auth-client allows an attacker who controls Active Directory configuration values to execute arbitrary commands as root on the target Linux host. The vulnerable code in Auth::AuthConf (src/lib/auth/authconf.rb) constructs Samba net ads join, net ads lookup -S, and net ads testjoin command strings by directly interpolating OU, dnshostname, AD username, and AD domain name values without validation or shell-quoting, then passes the assembled string to Ruby's Open3.popen2 or Open3.capture2, which delegates to /bin/sh. No public exploit has been identified at time of analysis and the vulnerability is not listed in the CISA KEV catalog.