Executive brief
YaST2 Users is a system administration tool used by Linux administrators to manage user accounts. A vulnerability in the password settings dialog allows an administrator viewing or editing a user's password configuration to accidentally trigger arbitrary commands with root privileges when that user's account data comes from an external LDAP directory. An attacker controlling LDAP user data could exploit this to gain complete system control.
Technical details
The vulnerability is an OS command injection in the get_password_term() function within src/include/users/dialogs.rb. The function reads shadowLastChange and shadowExpire fields from LDAP using GetString() without numeric validation, then passes the unsanitized values to format_days_after_epoch() which interpolates them directly into a shell command executed via Ruby backticks without quoting or escaping. An attacker controlling LDAP directory entries can inject shell metacharacters into these fields. The vulnerability requires an administrator to open or edit the "Password Settings" tab for an affected user account. The impact is unauthenticated remote code execution as root on the YaST2 administrator's system when browsing LDAP user entries.
Affected products
- SUSE yast2-users through 5.0.8
Timeline
- 2026-09-01: disclosed