CVE-2023-22809 PoC — Sudo 安全漏洞

Source

https://github.com/M4fiaB0y/CVE-2023-22809

Associated Vulnerability

Title:Sudo 安全漏洞 (CVE-2023-22809)
Description:In Sudo before 1.9.12p2, the sudoedit (aka -e) feature mishandles extra arguments passed in the user-provided environment variables (SUDO_EDITOR, VISUAL, and EDITOR), allowing a local attacker to append arbitrary entries to the list of files to process. This can lead to privilege escalation. Affected versions are 1.8.0 through 1.9.12.p1. The problem exists because a user-specified editor may contain a "--" argument that defeats a protection mechanism, e.g., an EDITOR='vim -- /path/to/extra/file' value.

Readme

# CVE-2023-22809
Ref: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-22809
## Exploit Title: sudo 1.8.0 - 1.9.12p1 - Privilege Escalation
 
## Exploit Author: n3m1.sys
### CVE: CVE-2023-22809
### Date: 2023/01/21
### Vendor Homepage: https://www.sudo.ws/
### Software Link: https://www.sudo.ws/dist/sudo-1.9.12p1.tar.gz
### Version: 1.8.0 to 1.9.12p1
### Tested on: Ubuntu Server 22.04 - vim 8.2.4919 - sudo 1.9.9
###
### Running this exploit on a vulnerable system allows a localiattacker to gain 
### a root shell on the machine.
###
### The exploit checks if the current user has privileges to run sudoedit or 
### sudo -e on a file as root. If so it will open the sudoers file for the
### attacker to add a line to gain privileges on all the files and get a root 
### shell.

File Snapshot


 [4.0K]  /data/pocs/8ebfeb01512c65ec8c94c273c99d2b21d43dda62
├── [1.1K]  exploit.sh
└── [ 788]  README.md

0 directories, 2 files

Shenlong Bot has cached this for you

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →

Goal Reached Thanks to every supporter — we hit 100%!