CVE-2025-32463

🚨 PoC: CVE-2025-32463 – Sudo chroot 탈출 취약점 sudo 버전 1.9.01.9.17p1 에 영향을 주는 치명적인 취약점으로, 사용자가 chroot을 탈출하여 실제 루트 파일시스템에 접근할 수 있게 합니다. 📌 설명 CVE-2025-32463은 sudo의 로컬 권한 상승 취약점으로, 특정 sudoers 설정을 가진 사용자가 chroot 감옥을 탈출하여 호스트 시스템의 루트 디렉터리에 접근할 수 있게 합니다. 🔥 영향 사용자의 /etc/sudoers에 다음과 같은 줄이 포함되어 있다면: someuser...

CVE-2025-32463

Reference: https://www.stratascale.com/vulnerability-alert-CVE-2025-32463-sudo-chroot Ubuntu 24.04.2 LTS 서버에서 Sudo v1.9.15p5를 사용하여 Sudo 규칙이 정의되지 않은 권한 없는 사용자로 PoC를 실행하면, chroot 환경 외부의 루트 셸이 생성됩니다. lowpriv@prod:/CVE-2025-32463$ id uid=1001lowpriv gid=1001lowpriv groups=1001lowpriv lowpriv@prod:...

CVE-2025-32463_Exploit

CVE-2025-32463Exploit 영향받는 버전 1.9.141.9.17 bash run.sh 성공 시 출력은 다음과 같습니다 neko@aosc-neko205 CVE-2025-32463Exploit@main $ bash run.sh + CVE-2025-32463 Sudo chroot 漏洞复现脚本 正在创建临时工作目录... 工作目录已创建: /tmp/sudoexploit.nc0EjT 正在创建 C 语言 payload woot1337.c... 正在设置 chroot 环境和恶意的 nsswitch.conf... 正在将 payload...

CVE-2025-32462-CVE-2025-32463-PoC-Lab

CVE-2025-32462 & CVE-2025-32463 – 고급 PoC 실습 환경 이 저장소는 두 가지 중요한 sudo 취약점에 대한 컨테이너 기반 실습 환경 과 상세한 PoC를 제공합니다: CVE-2025-32462 – sudo -h 호스트 일치 로직 우회 CVE-2025-32463 – sudo -R chroot NSS 라이브러리 탈출 연구 및 크레딧 원본 연구: Rich Mirch – Stratascale CRU PoC 및 실습 환경: MAAYTHM 기술 개요 CVE-2025-32462 – 호스트 검증 로직 우회 Sudo...

onetwoseven-writeup

HTB OneTwoSeven — 전체 워크스루 OneTwoSeven 의 처음부터 끝까지 완전한 워크스루로, HackTheBox의 은퇴한 Linux 머신입니다. 전체 체인: 결정적 자격 증명 생성 → SFTP chroot의 심볼릭 링크 탈출 → vim 스왑 파일 복구 → 방화벽으로 보호된 관리자 패널로 SSH 포트 포워딩 → 주석 처리된 Apache RewriteRules 우회 → RCE → CVE-2024-1086 nftables UAF로 루트 획득. 핵심 포인트: "비활성화"된 플러그인 업로드는 실제로 비활성화되지 않았습니다...

CVE-2025-32463-Sudo-Chroot-Escape

CVE-2025-32463-Sudo-Chroot-Escape 설명 이 저장소는 sudo 1.9.141.9.17 버전의 로컬 권한 상승 취약점인 CVE-2025-32463에 대한 Python 기반 PoCProof of Concept를 포함합니다. 사용자가 chroot 환경에서 명령을 실행할 수 있는 sudo 권한-R 플래그을 가진 경우, 공격자는 Name Service SwitchNSS 메커니즘을 악용하여 악성 공유 객체를 로드할 수 있습니다. 이를 통해 공격자는 chroot를 탈출하고 루트 사용자로 임의 코드를 실행할 수...

openSUSE 16 Security Update : rsync (openSUSE-SU-2026:21650-1)

The remote openSUSE 16 host has a package installed that is affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21650-1 advisory. - CVE-2026-53783: rrsync restricted-directory escape validation-vs-exec race + unsafe option allowlist bsc1269041. - CVE-2026-53784: Daemon...

OPENSUSE-SU-2026:21650-1 Security update for rsync

This update for rsync fixes the following issues: - CVE-2026-53783: rrsync restricted-directory escape validation-vs-exec race + unsafe option allowlist bsc1269041. - CVE-2026-53784: Daemon module-root chdir escape under "use chroot = no" bsc1269042. - CVE-2026-53785: --relative implied-parent...

SUSE-SU-2026:23323-1 Security update for rsync

This update for rsync fixes the following issues: - CVE-2026-53783: rrsync restricted-directory escape validation-vs-exec race + unsafe option allowlist bsc1269041. - CVE-2026-53784: Daemon module-root chdir escape under "use chroot = no" bsc1269042. - CVE-2026-53785: --relative implied-parent...

SUSE-SU-2026:23253-1 Security update for rsync

This update for rsync fixes the following issues: - CVE-2026-53783: rrsync restricted-directory escape bsc1269041. - CVE-2026-53784: Daemon module-root chdir escape under "use chroot = no" bsc1269042. - CVE-2026-53785: --relative implied-parent creation escapes the destination tree bsc1269043. -...

SUSE SLES15 Security Update : rsync (SUSE-SU-2026:3634-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3634-1 advisory. - CVE-2026-53783: rrsync restricted-directory escape validation-vs-exec race + unsafe option allowlist bsc1269041. - CVE-2026-53784...

SUSE CVE-2026-53793

rsync before 3.5.0 contains a path confinement bypass vulnerability that allows remote clients to escape the intended inner-module root confinement by constructing paths that resolve outside the chroot boundary when the module root contains a /./ boundary marker. Attackers can exploit improper...

AZL-95798 CVE-2026-53793 affecting package rsync for versions less than 3.5.0-1

rsync before 3.5.0 contains a path confinement bypass vulnerability that allows remote clients to escape the intended inner-module root confinement by constructing paths that resolve outside the chroot boundary when the module root contains a /./ boundary marker. Attackers can exploit improper...

ALPINE-CVE-2026-53793

rsync before 3.5.0 contains a path confinement bypass vulnerability that allows remote clients to escape the intended inner-module root confinement by constructing paths that resolve outside the chroot boundary when the module root contains a /./ boundary marker. Attackers can exploit improper...

CVE-2026-53793 rsync < 3.5.0 Path Confinement Bypass via /./ Boundary Marker in Chroot Mode

rsync before 3.5.0 contains a path confinement bypass vulnerability that allows remote clients to escape the intended inner-module root confinement by constructing paths that resolve outside the chroot boundary when the module root contains a /./ boundary marker. Attackers can exploit improper...

CVE-2026-53793

rsync before 3.5.0 contains a path confinement bypass vulnerability that allows remote clients to escape the intended inner-module root confinement by constructing paths that resolve outside the chroot boundary when the module root contains a /./ boundary marker. Attackers can exploit improper...

Linux Distros Unpatched Vulnerability : CVE-2026-55554

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Dompdf is an HTML to PDF converter for PHP. In versions 3.15 and prior, the validateLocalUri method enforces chroot boundaries with a strpos prefix check after...

DEBIAN-CVE-2026-55554

Dompdf is an HTML to PDF converter for PHP. In versions 3.15 and prior, the validateLocalUri method enforces chroot boundaries with a strpos prefix check after normalizing paths with realpath . Because normalization strips the trailing directory separator from $chrootPath , the check only...

CVE-2026-55554

Dompdf is an HTML to PDF converter for PHP. In versions 3.15 and prior, the validateLocalUri method enforces chroot boundaries with a strpos prefix check after normalizing paths with realpath . Because normalization strips the trailing directory separator from $chrootPath , the check only...

CVE-2026-55554

Dompdf is an HTML to PDF converter for PHP. In versions 3.15 and prior, the validateLocalUri method enforces chroot boundaries with a strpos prefix check after normalizing paths with realpath . Because normalization strips the trailing directory separator from $chrootPath , the check only...