We (SUSE) are currently reviewing all cron jobs we package for security issues. cacti packages a cron job and that lead us to have a look. During this I noticed that
in poller.php
575 $extra_args = api_plugin_hook_function('poller_command_args', $extra_args);
allows plugins to add arguments to the commands being executed. These arguments are not escaped, so it's left to the plugins to do this. I checked the default plugins and none of them are problematic.
IMHO (and I'm not really familiar with the code base) it might make sense to ensure proper escaping here to ensure defense in depth. Currently the code relies on every plugin getting this right.
We (SUSE) are currently reviewing all cron jobs we package for security issues. cacti packages a cron job and that lead us to have a look. During this I noticed that
in poller.php
575 $extra_args = api_plugin_hook_function('poller_command_args', $extra_args);
allows plugins to add arguments to the commands being executed. These arguments are not escaped, so it's left to the plugins to do this. I checked the default plugins and none of them are problematic.
IMHO (and I'm not really familiar with the code base) it might make sense to ensure proper escaping here to ensure defense in depth. Currently the code relies on every plugin getting this right.