mirror of
https://github.com/Security-Onion-Solutions/securityonion.git
synced 2026-09-20 14:49:38 +02:00
Josh Patterson
b018277d68
so-minion exported every line of the minion-controlled /opt/so/install.txt into its root shell and wrote the values unescaped into a Jinja-rendered pillar, allowing a rogue node to redefine PILLARFILE or run code on the master at the next pillar compile. pcapspace also fed minion-returned disk.usage output into bash arithmetic, which evaluates array subscripts. - Parse install.txt against an allowlist of known keys; never export - Validate MINION_ID before building pillar paths; make them readonly - Validate node type, IP, interface, hostname, heap and core values before any pillar is written; strip braces and control chars from the free-text node description - Require a numeric disk size before pcapspace arithmetic - Refuse manager node types on add/addVM so a remote node cannot rewrite the CA pillar; only setup may create them