YaST root shells via LDAP: 2 command injection bugs in SUSE's admin tools

An attacker who can control Active Directory configuration values (such as the Organizational Unit, DNS hostname, AD username, or AD domain name) can inject arbitrary OS commands that run as root. The yast2-auth-client module passes those values into shell commands without any quoting or escaping, so a malicious string in any of those fields gets executed by /bin/sh with full root privileges.

Affected estate

SUSE and openSUSE sysadmins who use yast2-auth-client to join or manage Active Directory domains

How to check

Run `rpm -q yast2-auth-client` to confirm the package is installed and check the version. Cross-reference with your distro's security advisory for the fixed version.

Included because

root-level command injection; common AD join workflow on SUSE systems; CVSS 8.8

Action

Update yast2-auth-client via `zypper update yast2-auth-client`. Until updated, do not run AD join or reconfiguration workflows through YaST.

Why it matters

An attacker who can influence AD configuration values gets root-level command execution on every host that runs the join or lookup workflow.

The yast2-users module (through version 5.0.8) has an OS command injection bug that fires when you view or edit a user's "Password Settings" tab. If a user entry in an external or federated LDAP directory contains a malicious shadowLastChange or shadowExpire value, YaST passes it straight into a shell command as root with no sanitization. An attacker who can write to that LDAP directory gets root on your YaST management host just by you opening the wrong user record.

Affected estate

SUSE and openSUSE sysadmins running yast2-users (through version 5.0.8) who manage users against an external or federated LDAP directory

How to check

Run `rpm -q yast2-users` and confirm the installed version. Versions at or below 5.0.8 are vulnerable.

Included because

root-level command injection; triggered by normal admin workflow; CVSS 8.0; external LDAP data is attacker-controllable

Action

Update via `zypper update yast2-users`. Do not open user password settings in YaST for LDAP-backed accounts until the update is applied.

Why it matters

Simply viewing a poisoned LDAP user entry in YaST triggers root command execution on your management host, no special setup required.

SmallRye GraphQL doesn't properly validate the size of float or string inputs when coercing them to BigInteger. An unauthenticated remote attacker can send a GraphQL query with a huge exponent float literal, forcing the server to allocate a massive BigInteger object. That eats all your CPU or blows through heap memory, crashing the app with an OutOfMemoryError.

Affected estate

Java developers and sysadmins running applications that use SmallRye GraphQL (commonly found in Quarkus and WildFly stacks)

How to check

Check your project's dependency tree for `io.smallrye:smallrye-graphql` and confirm the version. Maven: `mvn dependency:tree | grep smallrye-graphql`. Gradle: `gradle dependencies | grep smallrye-graphql`.

Included because

unauthenticated; remote denial of service; internet-facing GraphQL endpoints; CVSS 7.5

Action

Update the SmallRye GraphQL dependency to the patched version. As a short-term mitigation, enforce query depth and complexity limits at your API gateway.

Why it matters

An unauthenticated attacker can crash your GraphQL service remotely with a single crafted query, causing a denial of service.

RESTEasy's SourceProvider has an XXE (XML External Entity) bug. An unauthenticated attacker can send a crafted XML request with a DOCTYPE declaration pointing to local files, and the server will read those files and include their contents in the HTTP response. Any endpoint that accepts application/xml and returns a Source or StreamSource type is exposed. No auth needed.

Affected estate

Java developers and sysadmins running RESTEasy-based APIs (commonly found in Quarkus, WildFly, and JBoss EAP) that accept XML input

How to check

Search your dependency tree for `org.jboss.resteasy:resteasy-core` or `resteasy-jaxrs` and check the version. Review endpoint code for Source/StreamSource return types paired with XML consumption.

Included because

unauthenticated; remote file read via XXE; no user interaction; internet-facing REST endpoints; CVSS 7.5

Action

Update RESTEasy to the patched version. As an interim fix, remove application/xml from the @Consumes annotation on affected endpoints, or deploy a WAF rule blocking XML payloads with DOCTYPE declarations.

Why it matters

An unauthenticated attacker can read sensitive files from your server (like /etc/passwd, configuration files, or secrets) through a single HTTP request.