Sploitus

Exploit for Inclusion of Functionality from Untrusted Control Sphere in Sudo Project Sudo

CVE-2025-32463

githubexploit · 2025-08-09

Exploit Code

README43 lines
## https://sploitus.com/exploit?id=212FD63A-AE7B-56EB-B092-EA2209413C3D
# Sudo CVE-2025-32463  — PoC ![GitHub last commit](https://img.shields.io/github/last-commit/behnamvanda/CVE-2025-32463)

This repository hosts an experimental exploit demonstrating a critical vulnerability in the **sudo** utility, identified as **CVE-2025-32463**. This flaw permits a non-privileged user to gain root-level access on affected systems. The vulnerability was originally uncovered by security researcher Rich Mirch.

> ⚠️ **Warning:**
> This PoC is for educational and authorized testing purposes only. Do not use this code on systems you do not own or have explicit permission to assess.

---

  

---

## Sudo Vulnerable Version

* A vulnerable sudo version with chroot (`-R` flag) support, specifically versions from **1.9.14** up to **1.9.17**

---

## Usage Overview

1. Clone the exploit repository:

   ```bash
   git clone https://github.com/behnamvanda/CVE-2025-32463
   cd CVE-2025-32463
   ```


2. Execute the proof-of-concept script:

   ```bash
   bash vanda_sudo.sh
   ```

## Mitigation Steps for Ubuntu 24.04

* For devices connected to the internet, run:

  ```bash
  sudo apt update && sudo apt upgrade
  ```