cve

I discovered two vulnerabilities in Sudo. Upgrade to Sudo 1.9.17p1 or later. CVE-2025-32462 - Sudo Host Option Elevation of Privilege Vulnerability CVE-2025-32462 has remained unnoticed for over 12 years, despite being present in the code all along. It relies on a specific yet common configuration where Sudo rules are restricted to certain hostnames or hostname patterns. If these conditions are met, privilege escalation to root requires no exploit. Write-up: Sudo Host Option Elevation of Privilege Advisories Sudo: https://www.sudo.ws/security/advisories/host_any/ RedHat: https://access.redhat.com/security/cve/cve-2025-32462 Ubuntu: https://ubuntu.com/security/notices/USN-7604-1 Debian: https://lists.debian.org/debian-security-announce/2025/msg00118.html Amazon: https://explore.alas.aws.amazon.com/CVE-2025-32462.html Gentoo: https://bugs.gentoo.org/show_bug.cgi?id=CVE-2025-32462 CVE-2025-32463 - Sudo chroot Elevation of Privilege Vulnerability CVE-2025-32463 The default Sudo configuration is vulnerable. Although the vulnerability involves the Sudo chroot feature, it does not require any Sudo rules to be defined for the user. As a result, any local unprivileged user could potentially escalate privileges to root if a vulnerable version is installed. ...

I noticed the following changelog entry in sudo 1.9.5p1. This caught my attention so I decided to look further. I was unable to find an advisory, PoC, or CVE for this vulnerability. Using the details from the changelog message and fix, I decided to write an exploit for it. Using an Ubuntu 20.04.1 VM, I created a low privileged user named “lowpriv” and added a sudoedit rule for a root owned file /etc/test.txt. I also downloaded the source for sudo 1.9.5, compiled it, and installed it to /opt/sudo. ...

Pi-hole v5.2.1 is vulnerable to a critical stored cross site scripting vulnerability. An attacker with the ability to directly or indirectly query DNS with a malicious hostname can cause arbitrary JavaScript to execute when the Pi-hole administrator accesses the Query Log or Long-term Query Log pages on the web portal. The Pi-hole project released a fix on 12/24/2020 in v5.2.2. Shodan reports over 7,500 Pi-hole instances. This could be remotely exploited if these instances permit external DNS queries. Other possibilities may exist if a malformed DNS query is allowed. ...

I discovered several vulnerabilities in the MoFi4500 LTE router. Several vulnerabilities have not been patched, including an unauthenticated remote command injection and several undocumented backdoors. The full write-up can be viewed at https://cyberonesecurity.com/offensive-security/critical-vulnerabilities-discovered-in-mofi-routers/. Media Coverage https://www.cyberscoop.com/mofi-networks-routers-zero-day-critical-start/ https://www.zdnet.com/article/backdoors-left-unpatched-in-mofi-routers/ Follow the conversation on Twitter https://twitter.com/TeamAresSec/status/1301200248417775618?s=20

VMware Fusion 11.5.12 and prior are vulnerable to an elevation of privilege vulnerability. For more details please review the advisory and proof of concept on my GitHub page CVE-2020-3950.sh. VMware released the patch last week and a public advisory VMSA-2020-0005 today however it has been determined that the patch does not properly fix the vulnerability. I reached out to the VMware security team and received a response at 10:31 UTC 2020-03-18 - “We are aware of the situation and working on the next steps”. ...

Vulnerability Summary Signal Desktop v1.29 on Windows is vulnerable to an elevation of privilege vulnerability. During the startup the application will execute the c:\node_modules\.bin\wmic.exe binary if it exists. By default on Windows, low privileged users have the privilege to create folders under root level drives. A low privileged user can create a malicious wmic.exe which will be executed every time Signal Desktop starts by any user of the system. The malicious binary is executed in the background without the user’s knowledge. This is an example of horizontal privilege escalation. ...

Vulnerability Summary The pg_ctlcluster script in the postgresql-common package in Debian and Ubuntu is vulnerable to a local privilege escalation attack. pg_ctlcluster is a script used to manage PostgreSQL instances. A malicious actor with access to the postgres account can create arbitrary directories during startup or reload when called via systemd. This vulnerability can be leveraged to escalate privileges to root. It’s important to note this is not a vulnerability in PostgreSQL and is specific to Debian, Ubuntu, or any system that consumes the Debian postgresql-common package. ...

Vulnerability Summary IBM MQ for Linux and UNIX systems is vulnerable to a privilege escalation attack by forcing a setuid root binary to load a malicious library. A local attacker with access to the mqm account can execute arbitrary code as root. In October 2018 IBM published an advisory along with patches for several versions. The goal of this post is to show how the RPATH/RUNPATH value could potentially be leveraged for privilege escalation. When specified at compile time this path is embedded in the binary and is the first path searched when searching for a library if the dependent library specified does not contain a slash. Details on how this works can be found in the ld.so man page. ...

Vulnerability Summary During startup the PIA Windows service(pia-service.exe) loads the OpenSSL library from C:\Program Files\Private Internet Access\libeay32.dll. This library attempts to load the C:\etc\ssl\openssl.cnf configuration file. By default on Windows systems, authenticated users can create directories under C:\. A low privileged user can create an openssl.cnf configuration file to load a malicious OpenSSL engine library resulting in arbitrary code execution as SYSTEM when the service starts. The root cause is when the OpenSSL libraries were built, the OPENSSLDIR parameter was set to a path which a low privileged user can modify or create. I believe this issue is lurking in many Windows applications that bundle OpenSSL libraries. I have discovered the same vulnerability in several other Windows applications and will be disclosing those findings when patches are available. I created a simple tool to help identify potentially vulnerable OpenSSL libraries - https://github.com/mirchr/openssldir_check. CVE-2019-12572 has been patched in v1.2.1. The latest Windows desktop client can be upgraded automatically via the application or manually from the download page at Private Internet Access. Walkthrough While hunting for potential vulnerabilities in the Windows Private Internet Access desktop application I noticed a failed call to open the c:\etc\ssl\openssl.cnf file during the service startup. This caught my attention and I needed to research this further. But before I get into the details of that, let’s take a step back and see how I arrived there.

The barracudavpn component of the Barracuda VPN Client prior to version 5.0.2.7 for Linux, macOS, and OpenBSD runs as a privileged process and can allow an unprivileged local attacker to load a malicious library, resulting in arbitrary code executing as root. This post will walk through the process on how I found and exploited the vulnerability on Linux. The full PoC will also work on macOS. When researching for potential vulnerabilities with privileged binaries a test system should be used to avoid causing damage or negative impacts.