CVE-2021-40084: 
Linux Debian vulnerability analysis and mitigation

opensysusers through 0.6 contains a security vulnerability (CVE-2021-40084) where it does not safely use eval on files in sysusers.d that may contain shell metacharacters. For example, it allows command execution via a crafted GECOS field whereas systemd-sysusers (a program with the same specification) does not do that (Debian Bug).

The vulnerability stems from the unsafe use of shell's eval command on everything in sysusers.d files. The program processes these files without properly sanitizing input, particularly in the GECOS field, which can contain shell meta-characters that should not result in code execution. This behavior differs from systemd-sysusers, which handles the same input safely (Debian Bug). The vulnerability has been assigned a CVSS v3.1 base score of 9.8 CRITICAL with vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H (NVD).

The vulnerability allows an attacker to execute arbitrary commands through crafted input in the GECOS field of sysusers.d configuration files. For example, an attacker could create a configuration that executes destructive commands when processed, such as deleting system files (Debian Bug).

The vulnerability was fixed in opensysusers version 0.6-3 by modifying how the GECOS field is processed to avoid using eval. The patch sets the GECOS field without using eval, under the assumption that the double quote character is not valid for Type, Name, and ID fields (Debian Bug).