# N/A
## 漏洞概述
在 Sudo 版本 1.8.28 之前的版本中，拥有 Runas ALL sudoer 账户的攻击者可以绕过某些策略黑名单和会话 PAM 模块，导致日志记录不正确。例如，通过使用一个精心设计的用户 ID 调用 sudo 命令，可以绕过 !root 配置以及 USER= 日志记录。
## 影响版本
- Sudo 版本 1.8.28 之前的版本
## 细节
攻击者可以通过调用 `sudo -u \#$((0xffffffff))` 命令，利用精心设计的用户 ID 来绕过策略黑名单和会话 PAM 模块，导致日志记录不准确。
## 影响
- 可以绕过 `!root` 配置
- 可以绕过 `USER=` 日志记录
| # | POC 描述 | 源链接 | 神龙链接 |
|---|---|---|---|
| 1 | None | https://github.com/FauxFaux/sudo-cve-2019-14287 | POC详情 |
| 2 | This is a container built for demonstration purposes that has a version of the sudo command which is vulnerable to CVE-2019-14287 | https://github.com/CashWilliams/CVE-2019-14287-demo | POC详情 |
| 3 | Sudo exploit | https://github.com/n0w4n/CVE-2019-14287 | POC详情 |
| 4 | None | https://github.com/gurneesh/CVE-2019-14287-write-up | POC详情 |
| 5 | Sudo Security Bypass (CVE-2019-14287) | https://github.com/shallvhack/Sudo-Security-Bypass-CVE-2019-14287 | POC详情 |
| 6 | None | https://github.com/huang919/cve-2019-14287-PPT | POC详情 |
| 7 | cve-2019-14287 | https://github.com/wenyu1999/sudo- | POC详情 |
| 8 | None | https://github.com/Sindadziy/cve-2019-14287 | POC详情 |
| 9 | Containerized and deployable use of the CVE-2019-14287 vuln. View README.md for more. | https://github.com/CMNatic/Dockerized-CVE-2019-14287 | POC详情 |
| 10 | Sudo Vulnerability CVE-2019-14287 | https://github.com/axax002/sudo-vulnerability-CVE-2019-14287 | POC详情 |
| 11 | Documentation for Sudo Security Bypass - CVE 2019-14287 | https://github.com/SachinthaDeSilva-cmd/Exploit-CVE-2019-14287 | POC详情 |
| 12 | Sudo Security Policy bypass Vulnerability | https://github.com/HussyCool/CVE-2019-14287-IT18030372- | POC详情 |
| 13 | None | https://github.com/ShianTrish/sudo-Security-Bypass-vulnerability-CVE-2019-14287 | POC详情 |
| 14 | This is a brief exploitation of CVE-2019-14287 Sudo Security Bypass Vulnerability. | https://github.com/ejlevin99/Sudo-Security-Bypass-Vulnerability | POC详情 |
| 15 | This is the exploitation of sudo security bypass vulnerability | https://github.com/thinuri99/Sudo-Security-Bypass-Vulnerability-CVE-2019-14287- | POC详情 |
| 16 | None | https://github.com/janod313/-CVE-2019-14287-SUDO-bypass-vulnerability | POC详情 |
| 17 | None | https://github.com/DewmiApsara/CVE-2019-14287 | POC详情 |
| 18 | Scripts to verify and execute CVE-2019-14287 as part of Research | https://github.com/M108Falcon/Sudo-CVE-2019-14287 | POC详情 |
| 19 | None | https://github.com/edsonjt81/CVE-2019-14287- | POC详情 |
| 20 | CVE-2019-14287 | https://github.com/DularaAnushka/Linux-Privilege-Escalation-using-Sudo-Rights | POC详情 |
| 21 | None | https://github.com/crypticdante/CVE-2019-14287 | POC详情 |
| 22 | None | https://github.com/Hasintha-98/Sudo-Vulnerability-Exploit-CVE-2019-14287 | POC详情 |
| 23 | None | https://github.com/5l1v3r1/cve-2019-14287sudoexp | POC详情 |
| 24 | None | https://github.com/MariliaMeira/CVE-2019-14287 | POC详情 |
| 25 | None | https://github.com/Ijinleife/CVE-2019-14287 | POC详情 |
| 26 | None | https://github.com/H3xL00m/CVE-2019-14287 | POC详情 |
| 27 | None | https://github.com/n3ov4n1sh/CVE-2019-14287 | POC详情 |
| 28 | None | https://github.com/c0d3cr4f73r/CVE-2019-14287 | POC详情 |
| 29 | None | https://github.com/Sp3c73rSh4d0w/CVE-2019-14287 | POC详情 |
| 30 | None | https://github.com/0xwh1pl4sh/CVE-2019-14287 | POC详情 |
| 31 | None | https://github.com/N3rdyN3xus/CVE-2019-14287 | POC详情 |
| 32 | None | https://github.com/NyxByt3/CVE-2019-14287 | POC详情 |
| 33 | None | https://github.com/lemonadern/poc-cve-2019-14287 | POC详情 |
| 34 | None | https://github.com/h3xcr4ck3r/CVE-2019-14287 | POC详情 |
| 35 | None | https://github.com/n3rdh4x0r/CVE-2019-14287 | POC详情 |
| 36 | In Sudo before 1.8.28, an attacker with access to a Runas ALL sudoer account can bypass certain policy blacklists and session PAM modules, and can cause incorrect logging, by invoking sudo with a crafted user ID. For example, this allows bypass of !root configuration, and USER= logging, for a "sudo -u \#$((0xffffffff))" command. | https://github.com/projectdiscovery/nuclei-templates/blob/main/code/cves/2019/CVE-2019-14287.yaml | POC详情 |
| 37 | None | https://github.com/h3x0v3rl0rd/CVE-2019-14287 | POC详情 |
暂无评论