Executive brief
YaST2 auth-client is a SUSE system configuration tool that manages authentication settings, including integration with Active Directory. An attacker who can control Active Directory configuration values (such as organizational unit, domain name, or username) can inject arbitrary shell commands that execute with root privileges on the target system, potentially leading to complete system compromise.
Technical details
The vulnerability is an OS command injection flaw in the Auth::AuthConf component (src/lib/auth/authconf.rb) in yast2-auth-client. The code assembles Samba net ads join, net ads lookup, and net ads testjoin commands by directly interpolating unvalidated and unquoted user-controlled configuration values (organizational unit, DNS hostname, AD username, AD domain name) into a shell command string, then passes it to Ruby's Open3.popen2 or Open3.capture2 functions which execute it through /bin/sh. An attacker controlling these Active Directory configuration values can inject shell metacharacters to break out of the intended command and execute arbitrary code. No input validation or shell escaping is performed on the interpolated values. The attack requires ability to modify Active Directory configuration, and successful exploitation results in arbitrary command execution as root.
Affected products
- SUSE YaST2 auth-client <UNKNOWN>
Timeline
- 2026-09-01: disclosed