CVE-2025-32463

🚨 PoC：CVE-2025-32463 – Sudo chroot 逃逸漏洞 一个影响 sudo 1.9.0 至 1.9.17p1 版本的关键漏洞，允许用户逃离 chroot 并访问真实的根文件系统。 📌 描述 CVE-2025-32463 是 sudo 中的一个本地权限提升 漏洞，使得具有特定 sudoers 配置的用户能够逃出 chroot 监狱并访问宿主系统的根目录。 🔥 影响 如果您的 /etc/sudoers 包含如下行： someuser ALL=ALL:ALL CHROOT=/path/to/jail /path/to/elf-binary 那么您的系统可能存在漏洞 。 ...

CVE-2025-32463

参考：https://www.stratascale.com/vulnerability-alert-CVE-2025-32463-sudo-chroot 在运行 Sudo v1.9.15p5 的 Ubuntu 24.04.2 LTS 服务器上执行该 PoC，使用一个未定义任何 Sudo 规则的非特权用户，最终会在 chroot 环境之外获得一个 root shell。 lowpriv@prod:/CVE-2025-32463$ id uid=1001lowpriv gid=1001lowpriv groups=1001lowpriv lowpriv@prod:...

CVE-2025-32462-CVE-2025-32463-PoC-Lab

CVE-2025-32462 与 CVE-2025-32463 – 高级 PoC 实验环境 本仓库提供了一个基于容器的实验环境 以及两个关键 sudo 漏洞的详细 PoC： CVE-2025-32462 – sudo -h 主机匹配逻辑绕过 CVE-2025-32463 – sudo -R chroot NSS 库逃逸 研究与致谢 原始研究由 Rich Mirch – Stratascale CRU 完成 PoC 与实验环境由 MAAYTHM 提供 技术概述 CVE-2025-32462 – 主机验证逻辑绕过 Sudo 通过 /etc/sudoers 中的 HostAlias...

CVE-2025-32463-Sudo-Chroot-Escape

CVE-2025-32463-Sudo-Chroot-Escape Description This repository contains a Python-based Proof of Concept PoC for CVE-2025-32463, a local privilege escalation vulnerability in the sudo versions 1.9.14 through 1.9.17. When a user has sudo privileges to run a command within a chroot environment -R fla...

onetwoseven-writeup

HTB OneTwoSeven — 完整通关攻略 针对已退役的 HackTheBox Linux 机器 OneTwoSeven 的完整端到端通关攻略。完整链路：确定性凭据生成 → SFTP chroot 符号链接逃逸 → vim 交换文件恢复 → SSH 端口转发至受防火墙保护的管理面板 → 绕过被注释掉的 Apache 重写规则 → RCE → 利用 CVE-2024-1086 （nftables UAF）获取 root。 核心亮点： “已禁用”的插件上传并未真正禁用——插件管理器的 switch 匹配的是 REQUESTURI，因此可以借助 处于活动状态...

CVE-2025-32463_Exploit

CVE-2025-32463Exploit 受危害版本 1.9.14 to 1.9.17 root@kitploit: bash run.sh 成功如下 root@kitploit: neko@aosc-neko205 CVE-2025-32463Exploit@main $ bash run.sh + CVE-2025-32463 Sudo chroot 漏洞复现脚本 正在创建临时工作目录... 工作目录已创建: /tmp/sudoexploit.nc0EjT 正在创建 C 语言 payload woot1337.c... 正在设置 chroot 环境和恶意的...

openSUSE 16 Security Update : rsync (openSUSE-SU-2026:21650-1)

The remote openSUSE 16 host has a package installed that is affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21650-1 advisory. - CVE-2026-53783: rrsync restricted-directory escape validation-vs-exec race + unsafe option allowlist bsc1269041. - CVE-2026-53784: Daemon...

OPENSUSE-SU-2026:21650-1 Security update for rsync

This update for rsync fixes the following issues: - CVE-2026-53783: rrsync restricted-directory escape validation-vs-exec race + unsafe option allowlist bsc1269041. - CVE-2026-53784: Daemon module-root chdir escape under "use chroot = no" bsc1269042. - CVE-2026-53785: --relative implied-parent...

SUSE-SU-2026:23253-1 Security update for rsync

This update for rsync fixes the following issues: - CVE-2026-53783: rrsync restricted-directory escape bsc1269041. - CVE-2026-53784: Daemon module-root chdir escape under "use chroot = no" bsc1269042. - CVE-2026-53785: --relative implied-parent creation escapes the destination tree bsc1269043. -...

SUSE SLES15 Security Update : rsync (SUSE-SU-2026:3634-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3634-1 advisory. - CVE-2026-53783: rrsync restricted-directory escape validation-vs-exec race + unsafe option allowlist bsc1269041. - CVE-2026-53784...

SUSE CVE-2026-53793

rsync before 3.5.0 contains a path confinement bypass vulnerability that allows remote clients to escape the intended inner-module root confinement by constructing paths that resolve outside the chroot boundary when the module root contains a /./ boundary marker. Attackers can exploit improper...

ALPINE-CVE-2026-53793

rsync before 3.5.0 contains a path confinement bypass vulnerability that allows remote clients to escape the intended inner-module root confinement by constructing paths that resolve outside the chroot boundary when the module root contains a /./ boundary marker. Attackers can exploit improper...

AZL-95798 CVE-2026-53793 affecting package rsync for versions less than 3.5.0-1

rsync before 3.5.0 contains a path confinement bypass vulnerability that allows remote clients to escape the intended inner-module root confinement by constructing paths that resolve outside the chroot boundary when the module root contains a /./ boundary marker. Attackers can exploit improper...

CVE-2026-53793 rsync < 3.5.0 Path Confinement Bypass via /./ Boundary Marker in Chroot Mode

rsync before 3.5.0 contains a path confinement bypass vulnerability that allows remote clients to escape the intended inner-module root confinement by constructing paths that resolve outside the chroot boundary when the module root contains a /./ boundary marker. Attackers can exploit improper...

CVE-2026-53793

rsync before 3.5.0 contains a path confinement bypass vulnerability that allows remote clients to escape the intended inner-module root confinement by constructing paths that resolve outside the chroot boundary when the module root contains a /./ boundary marker. Attackers can exploit improper...

Linux Distros Unpatched Vulnerability : CVE-2026-55554

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Dompdf is an HTML to PDF converter for PHP. In versions 3.15 and prior, the validateLocalUri method enforces chroot boundaries with a strpos prefix check after...

CVE-2026-55554

Dompdf is an HTML to PDF converter for PHP. In versions 3.15 and prior, the validateLocalUri method enforces chroot boundaries with a strpos prefix check after normalizing paths with realpath . Because normalization strips the trailing directory separator from $chrootPath , the check only...

DEBIAN-CVE-2026-55554

Dompdf is an HTML to PDF converter for PHP. In versions 3.15 and prior, the validateLocalUri method enforces chroot boundaries with a strpos prefix check after normalizing paths with realpath . Because normalization strips the trailing directory separator from $chrootPath , the check only...

UBUNTU-CVE-2026-55554

Dompdf is an HTML to PDF converter for PHP. In versions 3.15 and prior, the validateLocalUri method enforces chroot boundaries with a strpos prefix check after normalizing paths with realpath . Because normalization strips the trailing directory separator from $chrootPath , the check only...

CVE-2026-55554

Dompdf is an HTML to PDF converter for PHP. In versions 3.15 and prior, the validateLocalUri method enforces chroot boundaries with a strpos prefix check after normalizing paths with realpath . Because normalization strips the trailing directory separator from $chrootPath , the check only...