CVE-2024-32019
ndsudo: local privilege escalation via untrusted search path
- Published
- Apr 12, 2024
- Updated
- Sep 6, 2024
- Assigning CNA
- GitHub_M
- Evidence observed
- Aug 8, 2026
Primary CVSS
nvd · CVSS 3.1
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:HLow · next 30 days
- Percentile
- 66.8%
- Model date
- Oct 17, 2026
EPSS is a statistical estimate, not a certainty or a measure of impact. Combine it with CVSS, KEV status, exposure and your environment.
Summary
Netdata is an open source observability tool. In affected versions the `ndsudo` tool shipped with affected versions of the Netdata Agent allows an attacker to run arbitrary programs with root permissions. The `ndsudo` tool is packaged as a `root`-owned executable with the SUID bit set. It only runs a restricted set of external commands, but its search paths are supplied by the `PATH` environment variable. This allows an attacker to control where `ndsudo` looks for these commands, which may be a path the attacker has write access to. This may lead to local privilege escalation. This vulnerability has been addressed in versions 1.45.3 and 1.45.2-169. Users are advised to upgrade. There are no known workarounds for this vulnerability.
Sources
modules/exploits/linux/local/ndsudo_cve_2024_32019.rb
Metasploit Framework modulesDeclared conditions
- platform: Linux($.exploit_linux/local/ndsudo_cve_2024_32019.platform)
- verification: check_declared($.exploit_linux/local/ndsudo_cve_2024_32019.check)
- CVE-2024-32019-PoCExploit
Bash script for Privilege Escalation via "ndsudo" (Netdata Local Exploit)
- cve-2024-32019-PoCDetection
Checks Netdata ndsudo SUID PATH privilege escalation exposure for CVE-2024-32019 and validates patches without weaponized exploitation.
- CVE-2024-32019-POCExploit
POC for netdata ndsudo vulnerability - CVE-2024-32019
CVE-2024-32019 is a high-severity local privilege escalation vulnerability in Netdata (versions >= 1.44.0-60 < 1.45.3), caused by insecure use of the PATH variable in the ndsudo SUID binary, allowing attackers to execute arbitrary commands as root.
Python PoC for Netdata LPE (CVE-2024-32019) exploiting unsanitized PATH in ndsudo to escalate privileges to root via hijacked binaries.
- CVE-2024-32019-ndsudoExploit
Bash-based privilege escalation exploit for CVE-2024-32019 in Netdata Agent's ndsudo tool, leveraging untrusted PATH search to execute arbitrary binaries with root permissions.
Netdata ndsudo Privilege Escalation PoC
Proof-of-concept exploit for CVE-2024-32019 demonstrating local privilege escalation via untrusted search path in Netdata's ndsudo plugin. Includes compile instructions and deployment steps.
- CVE-2024-32019-pocExploit
Netdata ndsudo PoC
- CVE-2024-32019_pocExploit
This is an alternative poc for the CVE-2024-32019 written in python
Netdata ndsudo local privilage escalation workflow and POC (CVE-2024-32019)
🔓 Local Privilege Escalation (ndsudo) en Netdata CVE-2024-32019. Explotación de configuraciones débiles. 🛡️
Proof-of-concept exploit for CVE-2024-32019 vulnerability, written in C for testing and verification of the security flaw.
Responsible use
Use vulnerability information only on systems you own or are authorized to test. Kitploit links to public research metadata and does not store exploit code or malicious payloads.