# Sudo-Security-Bypass-CVE-2019-14287

**Repository Path**: pwn2security/Sudo-Security-Bypass-CVE-2019-14287

## Basic Information

- **Project Name**: Sudo-Security-Bypass-CVE-2019-14287
- **Description**: CVE-2019-14287
- **Primary Language**: Unknown
- **License**: MIT
- **Default Branch**: master
- **Homepage**: None
- **GVP Project**: No

## Statistics

- **Stars**: 0
- **Forks**: 0
- **Created**: 2021-02-01
- **Last Updated**: 2021-02-01

## Categories & Tags

**Categories**: Uncategorized

**Tags**: None

## README

# Sudo-Security-Bypass-CVE-2019-14287
===========================================================================

		 ██████╗██╗   ██╗███████╗    ██████╗  ██████╗  ██╗ █████╗        ██╗██╗  ██╗██████╗  █████╗ ███████╗
		██╔════╝██║   ██║██╔════╝    ╚════██╗██╔═████╗███║██╔══██╗      ███║██║  ██║╚════██╗██╔══██╗╚════██║
		██║     ██║   ██║█████╗█████╗ █████╔╝██║██╔██║╚██║╚██████║█████╗╚██║███████║ █████╔╝╚█████╔╝    ██╔╝
		██║     ╚██╗ ██╔╝██╔══╝╚════╝██╔═══╝ ████╔╝██║ ██║ ╚═══██║╚════╝ ██║╚════██║██╔═══╝ ██╔══██╗   ██╔╝
		╚██████╗ ╚████╔╝ ███████╗    ███████╗╚██████╔╝ ██║ █████╔╝       ██║     ██║███████╗╚█████╔╝   ██║
		 ╚═════╝  ╚═══╝  ╚══════╝    ╚══════╝ ╚═════╝  ╚═╝ ╚════╝        ╚═╝     ╚═╝╚══════╝ ╚════╝    ╚═╝

                                    
                                      
                                     Sudo Security Bypass Test

                        ========= By Vivek Yadav (www.shallvhack.com)=========
=============================================================================

<p align="center">
  <p align="center">
      <a href="https://www.gnu.org/software/bash/"><img alt="language" src="https://img.shields.io/badge/Lang-Bash%204.2+-blue.svg"></a>
      <a href="https://twitter.com/intent/follow?screen_name=shallvhack"><img alt="language" src="https://img.shields.io/twitter/follow/shallvhack?label=Follow%20%20ShallVhack&style=social"></a>
    </p>
</p>

# Vulnerability Description
In Sudo before 1.8.28, an attacker with access to a Runas ALL sudoer account can bypass certain policy blacklists and session PAM modules, and can cause incorrect logging, by invoking sudo with a crafted user ID. For example, this allows bypass of !root configuration, and USER= logging, for a "sudo -u \#$((0xffffffff))" command.

# Script Description
This is a simple Proof of concept to test for recently disclosed Sudo Security Bypass vulnerability known as CVE-2019-14287.

# Recommendation
The best suggession for now would be to update the sudo to the version 1.8.28 or above.


# Contact me on:
Website: www.shallvhack.com

Twitter : www.twitter.com/shallvhack

Facebook : www.facebook.com/shallvhack

Github : https://github.com/shallvhack

LinkedIn : https://in.linkedin.com/in/vyvivekyadav04