Main
Vulnerability Database
Exploits
ID:10136 - Exploit for Input validation error in Sudo - CVE-2023-22809
ID:10136 - Exploit for Input validation error in Sudo - CVE-2023-22809
Published: June 28, 2024
Vulnerability identifier: #VU71332
Vulnerability risk: Low
CVE-ID: CVE-2023-22809
CWE-ID: CWE-20
Exploitation vector: Local access
Vulnerable software:
Sudo
Sudo
Link to public exploit:
Vulnerability description
The vulnerability allows a local user to escalate privileges on the system.
The vulnerability exists within the sudoedit (aka -e) feature due to insufficient validation of user-supplied input passed in the user-provided environment variables (SUDO_EDITOR, VISUAL, and EDITOR). The problem exists because a user-specified editor may contain a "--"
argument that defeats a protection mechanism, e.g., an EDITOR='vim --
/path/to/extra/file' value. A local user can append arbitrary entries to the list of files to process and escalate privileges on the system.
Remediation
Install updates from vendor's website.