Skip to content

Commit 5c503b8

Browse files
authored
Fix vtysh shell-ingestion security issue (#7759)
Fix vtysh shell-ingestion security issue Only expose the limited parameters of the command vtysh show.
1 parent dbd086b commit 5c503b8

File tree

1 file changed

+4
-2
lines changed

1 file changed

+4
-2
lines changed

files/image_config/sudoers/sudoers

+4-2
Original file line numberDiff line numberDiff line change
@@ -31,8 +31,10 @@ Cmnd_Alias READ_ONLY_CMDS = /bin/cat /var/log/syslog*, \
3131
/usr/bin/sensors, \
3232
/usr/bin/tail -F /var/log/syslog, \
3333
/usr/bin/rvtysh *, \
34-
/usr/bin/vtysh -c show *, \
35-
/usr/bin/vtysh -n [0-9] -c show *, \
34+
/usr/bin/vtysh -c show version, \
35+
/usr/bin/vtysh -c show bgp ipv[46] summary json, \
36+
/usr/bin/vtysh -n [0-9] -c show version, \
37+
/usr/bin/vtysh -n [0-9] -c show bgp ipv[46] summary json, \
3638
/usr/local/bin/decode-syseeprom, \
3739
/usr/local/bin/generate_dump, \
3840
/usr/local/bin/ipintutil, \

0 commit comments

Comments
 (0)