CVE-2019-14287

Summary

In Sudo before 1.8.28, an attacker with access to a Runas ALL sudoer account can bypass certain policy blacklists and session PAM modules, and can cause incorrect logging, by invoking sudo with a crafted user ID. For example, this allows bypass of !root configuration, and USER= logging, for a "sudo -u \#$((0xffffffff))" command.

Sources

• CVE-2019-14287-demoPoC

  This is a container built for demonstration purposes that has a version of the sudo command which is vulnerable to CVE-2019-14287

• Dockerized-CVE-2019-14287PoC

  Containerized and deployable use of the CVE-2019-14287 vuln. View README.md for more.

• CVE-2019-14287Scanner

  Shell script to detect CVE-2019-14287 sudo privilege escalation vulnerability. Scans systems for the flaw and reports affected configurations.

• Sudo-Vulnerability-Exploit-CVE-2019-14287Exploit

  Exploit for CVE-2019-14287, a sudo vulnerability allowing privilege escalation via user ID -1 on Linux systems. Enables arbitrary command execution as root.

• cve-2019-14287-PPTResearch

  Presentation detailing the CVE-2019-14287 sudo privilege escalation vulnerability, including exploitation techniques and mitigation strategies for Linux systems.

• poc-cve-2019-14287PoC

  Docker-based PoC demonstrating CVE-2019-14287 sudo privilege escalation via Runas user restriction bypass, with step-by-step reproduction instructions.

• CVE-2019-14287Exploit

  Sudo exploit

• Sudo-Security-Bypass-CVE-2019-14287PoC

  Sudo Security Bypass (CVE-2019-14287)

• CVE-2019-14287-CVE-2014-6271Exploit

  Exploit code for CVE-2019-14287 and CVE-2014-6271, targeting sudo privilege escalation and Shellshock vulnerabilities.

• sudo-vulnerability-CVE-2019-14287PoC

  Sudo Vulnerability CVE-2019-14287

• Linux-Privilege-Escalation-using-Sudo-RightsExploit

  CVE-2019-14287

• CVE-2019-14287-Exploit

  Shell script to detect and exploit CVE-2019-14287 sudo privilege bypass vulnerability, with standalone or scanner-integrated enumeration mode.

• Sudo-Security-Bypass-VulnerabilityExploit

  Exploit for CVE-2019-14287 that bypasses sudo security restrictions to gain elevated privileges on vulnerable Linux systems.

• sudo-cve-2019-14287PoC

  Exploit for CVE-2019-14287, a sudo vulnerability allowing privilege escalation to root via crafted user ID specification. Provides a proof-of-concept for testing and security assessments.

• CVE-2019-14287-write-upPoC

  Step-by-step demonstration of CVE-2019-14287 sudo vulnerability allowing restricted users to execute commands as root via crafted user IDs.

• CVE-2019-14287-IT18030372-PoC

  Sudo Security Policy bypass Vulnerability

• -CVE-2019-14287-SUDO-bypass-vulnerabilityExploit

  Exploit for CVE-2019-14287, a sudo privilege escalation vulnerability allowing command execution as root via crafted RunAs user specifications.

• Sudo-CVE-2019-14287Exploit

  Scripts to verify and execute CVE-2019-14287 as part of Research

• CVE-2019-14287Exploit

  Shell script demonstrating exploitation of CVE-2019-14287, a sudo privilege escalation vulnerability, for educational and penetration testing purposes.

• Exploit-CVE-2019-14287Exploit

  Documentation for Sudo Security Bypass - CVE 2019-14287

• sudo-Security-Bypass-vulnerability-CVE-2019-14287PoC

  Proof-of-concept for CVE-2019-14287, a sudo security bypass allowing privilege escalation via crafted user IDs.

• cve-2019-14287Exploit

  Exploit for CVE-2019-14287, a sudo privilege escalation vulnerability allowing command execution as root via crafted user ID.

• Exploiting-a-Linux-kernel-vulnerabilityResearch

  Local Root vulnerability- CVE-2019-13272 / Security Bypass Vulnerability – CVE-2019-14287

• Sudo-Security-Bypass-Vulnerability-CVE-2019-14287-Exploit

  This is the exploitation of sudo security bypass vulnerability

• CVE-2019-14287Exploit
• vulnerability-exploitationResearch

  Local Root vulnerability- CVE-2019-13272 / Security Bypass Vulnerability – CVE-2019-14287/Google Android - 'Stagefright' Remote Code Execution - CVE-2015-1538

• sudo-PoC

  cve-2019-14287

• sudo 1.8.27 - Security BypassExploit

  Mohin Paramasivam · linux · Oct 15, 2019