In api/data_interface.go, handlers like SubmitNodeAttributes, SubmitNodeUtilizations, and SubmitResourceUtilizations accept user-controlled fields (frontendNvpair.Name and frontendNvpair.Value) and pass them directly as arguments to exec.Command without sanitization or validation. If an attacker inputs fields starting with hyphens (e.g., - or --), they can inject arguments or flags into the underlying crm command.
Example:
cmd := exec.Command("crm", "node", "attribute", thisNode.Uname, "set", frontendNvpair.Name, frontendNvpair.Value)
In
api/data_interface.go, handlers likeSubmitNodeAttributes,SubmitNodeUtilizations, andSubmitResourceUtilizationsaccept user-controlled fields (frontendNvpair.NameandfrontendNvpair.Value) and pass them directly as arguments toexec.Commandwithout sanitization or validation. If an attacker inputs fields starting with hyphens (e.g.,-or--), they can inject arguments or flags into the underlyingcrmcommand.Example: