Description

A OS command injection vulnerability in yast2-auth-client allows an attacker who controls Active Directory configuration values to execute arbitrary commands as root on the configured host. Auth::AuthConf in src/lib/auth/authconf.rb assembles the Samba net ads join, net ads lookup -S and net ads testjoin invocations by interpolating configuration values into a single command string and passing that string to Open3.popen2 / Open3.capture2, which causes Ruby to run it through /bin/sh. The Organizational Unit (ou), dnshostname, AD user name and AD domain name values are neither validated nor shell-quoted.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.8",
  "pubDate": "2026-09-01T10:17:13.300Z",
  "pubdate": "2026-09-01T10:17:13.300Z",
  "executiveSummary": "This vulnerability is an OS command injection flaw located within the yast2-auth-client package. The issue stems from the unsafe handling of Active Directory configuration parameters, which are concatenated directly into shell commands. By manipulating configuration values such as the organizational unit (ou), dnshostname, AD user name, or AD domain name, an attacker can achieve arbitrary command execution.\nThe vulnerability carries a critical risk rating as the affected operations are executed with root privileges. Successful exploitation allows a malicious actor to compromise the host system entirely, bypass security controls, and potentially facilitate lateral movement within the network. Exploitation requires the attacker to control the Active Directory configuration values used by the application. This could occur if an attacker has administrative access to the domain configuration interface or can influence the input provided to the authentication client setup. There are no complex requirements beyond the ability to supply malicious input to the vulnerable configuration fields.",
  "technicalDetails": "The vulnerability resides in the Auth::AuthConf class within the file src/lib/auth/authconf.rb of the yast2-auth-client component. The flaw is triggered during the execution of Samba utility commands, specifically 'net ads join', 'net ads lookup -S', and 'net ads testjoin'. The implementation utilizes Ruby's Open3.popen2 and Open3.capture2 methods to execute these commands by passing them as single, interpolated strings.\nThe root cause of this vulnerability is the failure to sanitize or shell-quote user-supplied configuration variables before they are concatenated into the command string. Specifically, the 'ou' (Organizational Unit), 'dnshostname', 'AD user name', and 'AD domain name' inputs are treated as trusted data. Because the command strings are passed to the system shell (/bin/sh), the shell interprets shell metacharacters (such as backticks, semicolons, or pipes) contained within these input fields. An attacker providing a crafted string—for example, 'domain.name; malicious_command; #'—can cause the shell to terminate the intended command and execute the injected payload with the elevated privileges of the yast2-auth-client process.\nThe attack flow follows a predictable pattern: 1) The attacker identifies the configuration interface or configuration file where yast2-auth-client stores AD parameters. 2) The attacker submits a malicious payload into one of the vulnerable fields (e.g., the dnshostname parameter). 3) The application invokes the Auth::AuthConf logic, which assembles the shell command string using the unsanitized payload. 4) The Ruby Open3 library executes the resulting string through /bin/sh. 5) The shell executes the legitimate Samba command followed immediately by the attacker's arbitrary injected commands. 6) Since the yast2 process runs with root privileges, the injected commands are executed in the context of the root user, resulting in a full system compromise. This mechanism allows the attacker to install persistent backdoors, escalate privileges further, exfiltrate sensitive data, or perform reconnaissance within the internal network, all while bypassing intended application-level constraints."
}