Description

An OS command injection vulnerability was found in yast2-users. When displaying the "Password Settings" tab of a user, get_password_term() in src/include/users/dialogs.rb read the shadowLastChange and shadowExpire fields with GetString(), which performs no numeric validation, and passed the resulting string to format_days_after_epoch(). That helper interpolated the value into a shell command executed via Ruby backticks without quoting or escaping. Impact: an administrator who manages users against an external/federated LDAP directory via `yast2 users` triggers root command execution the moment they view or edit that particular user's "Password Settings" tab. No "join domain" or trust setup is required, just browsing/editing one user entry. This issue affects yast2-users through 5.0.8.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.0",
  "pubDate": "2026-09-01T10:17:13.160Z",
  "pubdate": "2026-09-01T10:17:13.160Z",
  "executiveSummary": "An OS command injection vulnerability exists in the yast2-users component, specifically within the handling of user password metadata.\nThe vulnerability occurs because untrusted input from an external LDAP directory is processed without adequate validation or sanitization before being passed to a shell execution environment.\nThis flaw allows an attacker capable of manipulating an LDAP user entry to achieve arbitrary command execution with root privileges on the host system.\nAffected systems include yast2-users through version 5.0.8.\nThe attack vector is triggered automatically when an administrator views or edits the 'Password Settings' tab for a maliciously crafted user entry, requiring no additional trust or domain join procedures.\nThis presents a critical risk to system integrity, as it grants unauthorized actors the ability to execute arbitrary commands as the root user upon simple administrative interaction with the compromised user profile.",
  "technicalDetails": "The vulnerability originates in the get_password_term() function within the file src/include/users/dialogs.rb. The root cause is the improper handling of shadowLastChange and shadowExpire fields retrieved from LDAP user objects.\nIn the affected versions (up to 5.0.8), the application utilizes the GetString() method to retrieve these fields from the LDAP source. Crucially, GetString() fails to perform any form of numeric validation or sanitization on the input, treating the data as an arbitrary string despite the fields expecting integer values representing Unix epoch days.\nThe unvalidated string is subsequently passed to the helper function format_days_after_epoch(). Within this function, the string is directly interpolated into a shell command string, which is then executed using Ruby backticks (``).\nBecause the input is not quoted, escaped, or validated for shell metacharacters, an attacker can inject malicious shell commands by crafting a shadowLastChange or shadowExpire value that terminates the intended command and appends arbitrary shell instructions.\nThe attack flow is as follows: 1. An attacker modifies an LDAP user object, inserting shell metacharacters (e.g., $(command) or ; command) into the shadowLastChange or shadowExpire attributes. 2. A system administrator using yast2-users accesses the 'Password Settings' tab for this specific user. 3. The application retrieves the poisoned LDAP attributes via GetString(). 4. The application triggers format_days_after_epoch(), which evaluates the string within a system shell context. 5. The injected payload executes with the privileges of the YaST process, which operates with root level authority.\nThis vulnerability is particularly dangerous due to its silent execution; the administrator is unaware that browsing a user profile is triggering a system compromise. There is no requirement for a pre-established domain trust or complex authentication bypass, as the vulnerability resides in the post-retrieval processing logic of the client-side user management interface. Post-exploitation, the attacker gains full control over the host, as the command execution occurs at the highest privilege level, facilitating lateral movement, data exfiltration, or complete persistence on the target infrastructure."
}