KaraZajac
dd5f4fa06d
Second new module this cycle; sibling of sudo_chwoot (CVE-2025-32463, same Stratascale/Rich Mirch disclosure). sudo's -h/--host option — meant only to pair with -l/--list — was honored when running a command, so a sudoers rule scoped to a host other than the current machine (and not ALL) is usable via 'sudo -h <host> <cmd>' for local root. Affects sudo 1.8.8 -> 1.9.17p0; fixed 1.9.17p1. CWE-863, CVSS 8.8 (not in KEV). detect(): version-gate [1.8.8, 1.9.17p0] via ctx->host->sudo_version (the host-restricted rule itself isn't probeable unprivileged, so VULNERABLE means 'vulnerable sudo present'). exploit(): discovers an abusable host-restricted rule from readable sudoers (or SKELETONKEY_SUDO_HOST), witnesses with 'sudo -n -h <host> id -u', pops 'sudo -h <host> /bin/bash' (SKELETONKEY_SUDO_CMD) only on a uid-0 witness; honest EXPLOIT_FAIL + operator guidance otherwise. Shared 'sudo' family; structural, arch=any; safety rank 96. auditd/sigma/falco rules, NOTICE.md (Rich Mirch / Stratascale) + MODULE.md, 4 detect() test rows. Wiring: registry, Makefile, cve_metadata (+JSON), verify-vm/targets.yaml (ubuntu1804 sudo 1.8.21p2 target, sweep pending). Docs: README + CVES.md + docs/index.html counts 40->41 modules / 35->36 CVEs; not-yet-verified lists + corpus pill.
64 lines
2.2 KiB
Markdown
64 lines
2.2 KiB
Markdown
# sudo_host — CVE-2025-32462
|
|
|
|
sudo `-h`/`--host` option honored beyond `-l` → abuse a host-restricted
|
|
sudoers rule for local root.
|
|
|
|
## The bug
|
|
|
|
`sudo -h <host>` (a.k.a. `--host`) exists so that, combined with `-l`,
|
|
you can list your sudo privileges *as they would apply on another host*.
|
|
The flaw: sudo also consulted the `-h` value when **running a command**
|
|
(and in `sudoedit`), so the host portion of a sudoers rule — normally
|
|
fixed to the machine you're on — becomes attacker-chosen.
|
|
|
|
If your sudoers contains a rule like:
|
|
|
|
```
|
|
alice webhost01 = (root) /usr/bin/systemctl
|
|
```
|
|
|
|
then on a *different* machine `alice` normally can't use it. With the
|
|
bug, `sudo -h webhost01 /usr/bin/systemctl ...` runs as root on the
|
|
local box. With a broader rule (`webhost01 = (ALL) ALL`), `sudo -h
|
|
webhost01 /bin/bash` is a root shell.
|
|
|
|
This matters most where one sudoers file (or LDAP/SSSD sudoers) is shared
|
|
across a fleet and rules are scoped per host.
|
|
|
|
## Affected range
|
|
|
|
| | |
|
|
|---|---|
|
|
| Affected | sudo 1.8.8 → 1.9.17p0 (~12-year-old behaviour) |
|
|
| Fixed | sudo 1.9.17p1 |
|
|
| Weakness | CWE-863 (Incorrect Authorization) |
|
|
| Severity | CVSS 8.8 (High); not in CISA KEV |
|
|
|
|
## Trigger / detection
|
|
|
|
`detect()` reads the sudo version (shared host fingerprint, else a live
|
|
`sudo --version`) and returns VULNERABLE inside `[1.8.8, 1.9.17p0]`,
|
|
OK otherwise. The exploitable precondition — a host-restricted sudoers
|
|
rule — is not reliably probeable from an unprivileged context, so the
|
|
empirical confirmation lives in the exploit path.
|
|
|
|
`exploit()`:
|
|
1. Resolves the host token to abuse: `SKELETONKEY_SUDO_HOST` env var, or
|
|
a best-effort scan of readable `/etc/sudoers` + `/etc/sudoers.d/*` for
|
|
a user-spec whose host is neither the current hostname nor `ALL`.
|
|
2. Witnesses with `sudo -n -h <host> id -u` (non-interactive).
|
|
3. On a uid-0 witness, execs `sudo -h <host> /bin/bash`
|
|
(override the command with `SKELETONKEY_SUDO_CMD`).
|
|
|
|
Returns `EXPLOIT_FAIL` with operator guidance when no abusable rule is
|
|
discoverable — it never fabricates root.
|
|
|
|
## Fix / mitigation
|
|
|
|
Upgrade sudo to 1.9.17p1 or later. There is no safe runtime toggle for
|
|
the `-h` behaviour short of the patch.
|
|
|
|
## Credit
|
|
|
|
Rich Mirch — Stratascale CRU (2025-06-30). See `NOTICE.md`.
|