It was found that luci was vulnerable to an arbitrary code execution flaw due to the use of the "eval" Python construct used on the web page templating level. An authenticated user could use this flaw to execute arbitrary code as the system-wide luci user or to elevate their privileges within luci and/or the managed cluster. An unchecked argument originating from the configuration file of the currently-selected cluster, and fetched from one of its nodes, could appear in the "eval" construct. As such, a user with the create_cluster or import_cluster roles, could create a crafted cluster.conf to take advantage of this flaw. Acknowledgements: This issue was discovered by Jan Pokorný of Red Hat.
IssueDescription: It was discovered that luci used eval() on inputs containing strings from the cluster configuration file when generating its web pages. An attacker with privileges to create or edit the cluster configuration could use this flaw to execute arbitrary code as the luci user on a host running luci.
This issue has been addressed in the following products: Red Hat Enterprise Linux 6 Via RHSA-2014:1390 https://rhn.redhat.com/errata/RHSA-2014-1390.html