Published: 18/01/2023 Updated: 17/11/2023

CVSS v3 Base Score: 7.8 | Impact Score: 5.9 | Exploitability Score: 1.8

VMScore: 0

In Sudo prior to 1.9.12p2, the sudoedit (aka -e) feature mishandles extra arguments passed in the user-provided environment variables (SUDO_EDITOR, VISUAL, and EDITOR), allowing a local malicious user to append arbitrary entries to the list of files to process. This can lead to privilege escalation. Affected versions are 1.8.0 up to and including 1.9.12.p1. The problem exists because a user-specified editor may contain a "--" argument that defeats a protection mechanism, e.g., an EDITOR='vim -- /path/to/extra/file' value.

Vulnerable Product	Search on Vulmon	Subscribe to Product
sudo project sudo 1.9.12
sudo project sudo
debian debian linux 10.0
debian debian linux 11.0
fedoraproject fedora 36
fedoraproject fedora 37
apple macos

Several security issues were fixed in Sudo ...

Sudo could be made to possibly edit arbitrary files if it received a specially crafted input ...

Matthieu Barjole and Victor Cutillas discovered that sudoedit in sudo, a program designed to provide limited super user privileges to specific users, does not properly handle '--' to separate the editor and arguments from files to edit A local user permitted to edit certain files can take advantage of this flaw to edit a file not permitted by the ...

In Sudo before 1912p2, the sudoedit (aka -e) feature mishandles extra arguments passed in the user-provided environment variables (SUDO_EDITOR, VISUAL, and EDITOR), allowing a local attacker to append arbitrary entries to the list of files to process This can lead to privilege escalation Affected versions are 180 through 1912p1 The proble ...

Synopsis Important: sudo security update Type/Severity Security Advisory: Important Red Hat Insights patch analysis Identify and remediate systems affected by this advisory View affected systems Topic An update for sudo is now available for Red Hat Enterprise Linux 82 Advanced Update Support, Red Hat Enterprise Linux 82 Telecommu ...

Synopsis Important: sudo security update Type/Severity Security Advisory: Important Red Hat Insights patch analysis Identify and remediate systems affected by this advisory View affected systems Topic An update for sudo is now available for Red Hat Enterprise Linux 74 Advanced Update SupportRed Hat Product Security has rated this ...

Synopsis Important: sudo security update Type/Severity Security Advisory: Important Red Hat Insights patch analysis Identify and remediate systems affected by this advisory View affected systems Topic An update for sudo is now available for Red Hat Enterprise Linux 76 Advanced Update SupportRed Hat Product Security has rated this ...

概述 Important: sudo security update 类型/严重性 Security Advisory: Important Red Hat Insights patch analysis Identify and remediate systems affected by this advisory View affected systems 标题 An update for sudo is now available for Red Hat Enterprise Linux 77 Advanced Update Support, Red Hat Enterprise Linux 77 Telco E ...

Synopsis Important: sudo security update Type/Severity Security Advisory: Important Red Hat Insights patch analysis Identify and remediate systems affected by this advisory View affected systems Topic An update for sudo is now available for Red Hat Enterprise Linux 84 Extended Update SupportRed Hat Product Security has rated this ...

Synopsis Important: Red Hat Virtualization Host 44z SP 1 security update batch#4 (oVirt-453-4) Type/Severity Security Advisory: Important Red Hat Insights patch analysis Identify and remediate systems affected by this advisory View affected systems Topic An update for redhat-release-virtualization-host and redhat-virtualization ...

Synopsis Important: sudo security update Type/Severity Security Advisory: Important Red Hat Insights patch analysis Identify and remediate systems affected by this advisory View affected systems Topic An update for sudo is now available for Red Hat Enterprise Linux 7Red Hat Product Security has rated this update as having a securi ...

Synopsis Important: Red Hat OpenShift Data Foundation 4130 security and bug fix update Type/Severity Security Advisory: Important Topic Updated images that include numerous enhancements, security, and bug fixes are now available in Red Hat Container Registry for Red Hat OpenShift Data Foundation 4130 on Red Hat Enterprise Linux 9Red Hat ...

DescriptionA vulnerability was found in sudo Exposure in how sudoedit handles user-provided environment variables leads to arbitrary file writing with privileges of the RunAs user (usually root) The prerequisite for exploitation is that the current user must be authorized by the sudoers policy to edit a file using sudoeditA vulnerability ...

ALAS-2023-289 Amazon Linux 2022 Security Advisory: ALAS-2023-289 Advisory Release Date: 2023-01-31 21:12 Pacific Advisory Updated Date: 2023-01-31 21:12 Pac ...

CVE-2023-22809 Impact of Sudo Vulnerability CVE-2023-22809 ...

sudo versions 180 through 1912p1 local privilege escalation exploit ...

Cisco ThousandEyes Enterprise Agent Virtual Appliance version thousandeyes-va-64-1804 0218 suffers from an unpatched vulnerability in sudoedit, allowed by sudo configuration, which permits a low-privilege user to modify arbitrary files as root and subsequently execute arbitrary commands as root ...

This exploit takes advantage of a vulnerability in sudoedit, part of the sudo package The sudoedit (aka sudo -e) feature mishandles extra arguments passed in the user-provided environment variables (SUDO_EDITOR, VISUAL, and EDITOR), allowing a local attacker to append arbitrary entries to the list of files to process This can lead to privilege es ...

Running this exploit on a vulnerable system allows a local attacker to gain a root shell on the machine.

CVE-2023-22809 CVE-2023-22809 is a critical vulnerability that affects the popular sudo software, specifically the sudoedit command This vulnerability allows an attacker to gain root privileges on a targeted system by exploiting a flaw present in the sudoedit command Exploiting the CVE-2023-22809 vulnerability involves passing a specially crafted argument to the sudoedit comm

Analysis & Exploit

CVE-2023-22809 Analysis & Exploit 基本情况漏洞编号：CVE-2023-22809 漏洞等级：高危漏洞评分：78分影响版本：sudo 180-sudo 1912p1(sudo>=180 or sudo <=1912p1) 攻击效果：本地提权攻击手法修改/etc/passwd中root为用户名，见exp_passwdsh 修改/etc/sudoers规定用户X可以无密码执行任何操作，�

CVE-2023-22809

patch_CVE-2023-22809 Bash Script: sudo Installation This Bash script automates the installation of the latest version of sudo on your system Prerequisites Linux-based operating system wget package installed (can be installed using the package manager) Usage Clone or download this repository to your local machine Navigate to the directory containing the script Open a termi

CVE-2023-22809 Ref: cvemitreorg/cgi-bin/cvenamecgi?name=CVE-2023-22809 Exploit Title: sudo 180 - 1912p1 - Privilege Escalation Exploit Author: n3m1sys CVE: CVE-2023-22809 Date: 2023/01/21 Vendor Homepage: wwwsudows/ Software Link: wwwsudows/dist/sudo-1912p1targz Version: 180 to 1912p1 Tested on: Ubuntu Server 2204 - vim 824919 - su

Minimal alternative to sudoedit

Rdoedit (RootDO edit) Minimal alternative to sudoedit This project aims to be a minimal alternative to sudoedit Sudoedit by itself is over 700 lines of code by itself, not including all the header files or the fact that it's part of sudo There is no reason why such a simple app should be so bloated or come bundled with bloat like sudo This readme is likely more verbose

A script to automate privilege escalation with CVE-2023-22809 vulnerability

CVE-2023-22809 sudo Privilege escalation Affected sudo versions: 180 to 1912p1 This script automates the exploitation of the CVE-2023-22809 vulnerability to gain a root shell The script checks if the current user has access to run the sudoedit or sudo -e command for some file with root privileges If it does it opens the sudoers file for the attacker to introduce the privi

Linux Privilege Escalation Exploit for CVE-2021-3560 (Sudoedit aka -e) - Local Privilege Escalation *For educational and authorized security research purposes only* Original Exploit Authors n3m1dotsys Vulnerability Description In Sudo before 1912p2, the sudoedit (aka -e) feature mishandles extra arguments passed in the user-provided environment variables (SUDO_EDITOR, VISUA

CVE-2023-22809 Linux Sudo

CVE-2023-22809-sudo-POC CVE-2023-22809 Linux Sudo

My README.md

Hi there 👋 My name is Martín, aka n3m1sys on Internet I'm a cybersecurity consultant and ethical hacker What do I do? I do not program very frequently Sometimes I develop exploit scripts, and simple programs to automate things List of exploits I developed githubcom/n3m1sys/CVE-2023-22809-sudoedit-privesc githubcom/n3m1sys/CVE-2018-16763-

My README.md

CWE-269 https://www.synacktiv.com/sites/default/files/2023-01/sudo-CVE-2023-22809.pdf https://www.sudo.ws/security/advisories/sudoedit_any/https://lists.debian.org/debian-lts-announce/2023/01/msg00012.html https://www.debian.org/security/2023/dsa-5321 http://www.openwall.com/lists/oss-security/2023/01/19/1 https://security.netapp.com/advisory/ntap-20230127-0015/http://packetstormsecurity.com/files/171644/sudo-1.9.12p1-Privilege-Escalation.html https://security.gentoo.org/glsa/202305-12 http://packetstormsecurity.com/files/172509/Sudoedit-Extra-Arguments-Privilege-Escalation.html http://seclists.org/fulldisclosure/2023/Aug/21 http://packetstormsecurity.com/files/174234/Cisco-ThousandEyes-Enterprise-Agent-Virtual-Appliance-Arbitrary-File-Modification.html https://support.apple.com/kb/HT213758 https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2QDGFCGAV5QRJCE6IXRXIS4XJHS57DDH/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/G4YNBTTKTRT2ME3NTSXAPTOKYUE47XHZ/https://nvd.nist.gov https://ubuntu.com/security/notices/USN-5811-1 https://ubuntu.com/security/notices/USN-5811-2

Get Started

CVE-2023-22809

Vulnerability Summary

Vulnerability Trend

Vendor Advisories

Exploits

Github Repositories

References

Vulmon Search

About

Products

Connect