CVE-2023-22809
published 2023-01-18CVE-2023-22809: In Sudo before 1.9.12p2, the sudoedit (aka -e) feature mishandles extra arguments passed in the user-provided environment variables (SUDO_EDITOR, VISUAL, and…
PriorityP183high7.8CVSS 3.1
AVLACLPRLUINSUCHIHAH
ITWEXPLOITVulnCheck KEV
Exploited in the wild
EPSS
55.37%
98.9th percentile
In Sudo before 1.9.12p2, the sudoedit (aka -e) feature mishandles extra arguments passed in the user-provided environment variables (SUDO_EDITOR, VISUAL, and EDITOR), allowing a local attacker to append arbitrary entries to the list of files to process. This can lead to privilege escalation. Affected versions are 1.8.0 through 1.9.12.p1. The problem exists because a user-specified editor may contain a "--" argument that defeats a protection mechanism, e.g., an EDITOR='vim -- /path/to/extra/file' value.
Affected
24 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apple | macos | < 13.4 | 13.4 |
| apple | macos_ventura | — | — |
| debian | debian_linux | — | — |
| debian | debian_linux | — | — |
| debian | sudo | < sudo 1.9.12p2-1 (bookworm) | sudo 1.9.12p2-1 (bookworm) |
| fedoraproject | fedora | — | — |
| fedoraproject | fedora | — | — |
| msrc | cbl2_sudo_1.9.12p2-1_on_cbl_mariner_2.0 | — | — |
| msrc | cm1_sudo_1.9.12p2-1_on_cbl_mariner_1.0 | — | — |
| paloalto | cloud_ngfw | — | — |
| paloalto | pan-os | — | — |
| paloalto | prisma_access | — | — |
| paloalto | prisma_sd-wan_ion | — | — |
| sudo_project | sudo | — | — |
| sudo_project | sudo | >= 0 < 1.9.5p2-3+deb11u1 | 1.9.5p2-3+deb11u1 |
| sudo_project | sudo | >= 0 < 1.9.12p2-1 | 1.9.12p2-1 |
| sudo_project | sudo | >= 0 < 1.9.12p2-1 | 1.9.12p2-1 |
| sudo_project | sudo | >= 0 < 1.9.12p2-1 | 1.9.12p2-1 |
| sudo_project | sudo | >= 0 < 1.8.21p2-3ubuntu1.5 | 1.8.21p2-3ubuntu1.5 |
| sudo_project | sudo | >= 0 < 1.8.31-1ubuntu1.4 | 1.8.31-1ubuntu1.4 |
| sudo_project | sudo | >= 0 < 1.9.9-1ubuntu2.2 | 1.9.9-1ubuntu2.2 |
| sudo_project | sudo | >= 0 < 1.8.9p5-1ubuntu1.5+esm7 | 1.8.9p5-1ubuntu1.5+esm7 |
| sudo_project | sudo | >= 0 < 1.8.16-0ubuntu1.10+esm1 | 1.8.16-0ubuntu1.10+esm1 |
| sudo_project | sudo | >= 1.8.0 < 1.9.12 | 1.9.12 |
Detection & IOCsextracted from sources · hover to see the quote
- →Monitor for sudoedit or 'sudo -e' invocations where SUDO_EDITOR, VISUAL, or EDITOR environment variables contain '--' followed by an additional file path, indicating an attempt to append arbitrary files to the edit list. ↗
- →Alert on any sudoedit process where the editor environment variable (SUDO_EDITOR/VISUAL/EDITOR) contains the string ' -- ' (space-dash-dash-space), as this is the specific bypass mechanism used to defeat sudo's file-list protection. ↗
- →Detect privilege escalation attempts by monitoring for unexpected writes to /etc/sudoers or sudoers.d files by processes spawned under sudoedit, especially when the writing user is not root. ↗
- →On Ubuntu 22.04 and 22.10 systems, treat sudoedit abuse as higher risk; the Metasploit module specifically targets sudo 1.9.9-1ubuntu2 on Ubuntu 22.04 and 1.9.11p3-1ubuntu1 on Ubuntu 22.10. ↗
- →Use pspy or equivalent process monitoring to detect when sensitive files (e.g., virtualenv activate scripts, cron-executed scripts) are modified by lower-privileged users via sudoedit, which may indicate CVE-2023-22809 exploitation. ↗
- ·The vulnerability only affects users who are already authorized by the sudoers policy to edit at least one file via sudoedit; it is not exploitable without an existing sudoedit permission entry. ↗
- ·A sudoers mitigation exists: adding 'Defaults!sudoedit env_delete+="SUDO_EDITOR VISUAL EDITOR"' prevents user-specified editors from being used, blocking the attack vector without patching. ↗
- ·Affected sudo versions are 1.8.0 through 1.9.12p1; the fix is present in 1.9.12p2 and later. Version checks in exploit tooling use the regex '(1\.8.*|1\.9\.[0-9]1?(p[1-3])?|1\.9\.12p1)' to confirm vulnerability. ↗
CVSS provenance
nvdv3.17.8HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
osv7.8HIGH
vulncheck7.8HIGH
vendor_debian7.8HIGH
vendor_msrc7.8HIGH
vendor_oracle7.8HIGH
vendor_redhat7.8HIGH
vendor_ubuntu7.8HIGH
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
sudo vulnerability
osv·2023-01-30·CVSS 7.8
CVE-2023-22809 [HIGH] sudo vulnerability
sudo vulnerability
USN-5811-1 fixed a vulnerability in Sudo. This update provides
the corresponding update for Ubuntu 14.04 ESM.
Original advisory details:
Matthieu Barjole and Victor Cutillas discovered that Sudo incorrectly
handled user-specified editors when using the sudoedit command. A local
attacker that has permission to use the sudoedit command could possibly use
this issue to edit arbitrary files. (CVE-2023-22809)
OSV
sudo vulnerability
osv·2023-01-18·CVSS 7.8
CVE-2023-22809 [HIGH] sudo vulnerability
sudo vulnerability
USN-5811-1 fixed a vulnerability in Sudo. This update provides
the corresponding update for Ubuntu 16.04 ESM.
Original advisory details:
Matthieu Barjole and Victor Cutillas discovered that Sudo incorrectly
handled user-specified editors when using the sudoedit command. A local
attacker that has permission to use the sudoedit command could possibly use
this issue to edit arbitrary files. (CVE-2023-22809)
OSV
CVE-2023-22809: In Sudo before 1
osv·2023-01-18·CVSS 7.8
CVE-2023-22809 [HIGH] CVE-2023-22809: In Sudo before 1
In Sudo before 1.9.12p2, the sudoedit (aka -e) feature mishandles extra arguments passed in the user-provided environment variables (SUDO_EDITOR, VISUAL, and EDITOR), allowing a local attacker to append arbitrary entries to the list of files to process. This can lead to privilege escalation. Affected versions are 1.8.0 through 1.9.12.p1. The problem exists because a user-specified editor may contain a "--" argument that defeats a protection mechanism, e.g., an EDITOR='vim -- /path/to/extra/file' value.
GHSA
GHSA-3vwp-294x-6v9c: In Sudo before 1
ghsa_unreviewed·2023-01-18
CVE-2023-22809 [HIGH] CWE-269 GHSA-3vwp-294x-6v9c: In Sudo before 1
In Sudo before 1.9.12p2, the sudoedit (aka -e) feature mishandles extra arguments passed in the user-provided environment variables (SUDO_EDITOR, VISUAL, and EDITOR), allowing a local attacker to append arbitrary entries to the list of files to process. This can lead to privilege escalation. Affected versions are 1.8.0 through 1.9.12.p1. The problem exists because a user-specified editor may contain a "--" argument that defeats a protection mechanism, e.g., an EDITOR='vim -- /path/to/extra/file' value.
OSV
sudo vulnerabilities
osv·2023-01-18·CVSS 5.5
CVE-2023-22809 [MEDIUM] sudo vulnerabilities
sudo vulnerabilities
Matthieu Barjole and Victor Cutillas discovered that Sudo incorrectly
handled user-specified editors when using the sudoedit command. A local
attacker that has permission to use the sudoedit command could possibly use
this issue to edit arbitrary files. (CVE-2023-22809)
It was discovered that the Protobuf-c library, used by Sudo, incorrectly
handled certain arithmetic shifts. An attacker could possibly use this
issue to cause Sudo to crash, resulting in a denial of service. This issue
only affected Ubuntu 22.04 LTS. (CVE-2022-33070)
VulnCheck
Sudo Sudo Improper Privilege Management
vulncheck·2023·CVSS 7.8
CVE-2023-22809 [HIGH] Sudo Sudo Improper Privilege Management
Sudo Sudo Improper Privilege Management
In Sudo before 1.9.12p2, the sudoedit (aka -e) feature mishandles extra arguments passed in the user-provided environment variables (SUDO_EDITOR, VISUAL, and EDITOR), allowing a local attacker to append arbitrary entries to the list of files to process. This can lead to privilege escalation. Affected versions are 1.8.0 through 1.9.12.p1. The problem exists because a user-specified editor may contain a "--" argument that defeats a protection mechanism, e.g., an EDITOR='vim -- /path/to/extra/file' value.
Affected: Sudo Sudo
Required Action: Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.
Exploitation References: https://securelist.com/exploits-and-vulnerabili
CISA ICS
ABB M2M Gateway
cisa_ics·2025-04-15
ABB M2M Gateway
ICS Advisory
##
ABB M2M Gateway
Release DateApril 15, 2025
Alert CodeICSA-25-105-08
Related topics:
Industrial Control System Vulnerabilities, Industrial Control Systems
View CSAF
## 1. EXECUTIVE SUMMARY
- CVSS v4 8.8
- ATTENTION: Exploitable remotely/low attack complexity
- Vendor: ABB
- Equipment: M2M Gateway
- Vulnerabilities: Integer Overflow or Wraparound, Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling'), Unquoted Search Path or Element, Untrusted Search Path, Use After Free, Out-of-bounds Write, Buffer Copy without Checking Size of Input ('Classic Buffer Overflow'), Missing Release of Memory after Effective Lifetime, Allocation of Resources Without Limits or Throttling, Improper Privilege Management, Improper Limitati
Palo Alto
PAN-SA-2024-0008 Informational Bulletin: Impact of OSS CVEs in PAN-OS
vendor_paloalto·2024-09-04·CVSS 6.0
CVE-2010-1622 [MEDIUM] PAN-SA-2024-0008 Informational Bulletin: Impact of OSS CVEs in PAN-OS
PAN-SA-2024-0008 Informational Bulletin: Impact of OSS CVEs in PAN-OS
The Palo Alto Networks Product Security Assurance team has evaluated the following open source software (OSS) CVEs as they relate to PAN-OS software. While PAN-OS software may include the
CVEs: CVE-2010-1622, CVE-2015-7552, CVE-2018-16840, CVE-2019-7639, CVE-2020-17049, CVE-2020-7774, CVE-2021-0131, CVE-2021-0132, CVE-2021-0133, CVE-2021-0134, CVE-2021-4044, CVE-2021-4160, CVE-2021-41773, CVE-2022-1343, CVE-2022-21449, CVE-2022-2274, CVE-2022-22963, CVE-2022-22965, CVE-2022-24697, CVE-2022-32207, CVE-2022-3358, CVE-2022-3996, CVE-2022-40664, CVE-2022-44792, CVE-2022-44793, CVE-2023-1255, CVE-2023-22809, CVE-2023-23919, CVE-2023-3341, CVE-2023-4236, CVE-2023-4863, CVE-2023-51767
Affected products: PAN-OS
Palo Alto
PAN-SA-2024-0008 Informational Bulletin: Impact of OSS CVEs in PAN-OS
vendor_paloalto·2024-09-04·CVSS 6.0
CVE-2022-22965 [MEDIUM] PAN-SA-2024-0008 Informational Bulletin: Impact of OSS CVEs in PAN-OS
PAN-SA-2024-0008 Informational Bulletin: Impact of OSS CVEs in PAN-OS
The Palo Alto Networks Product Security Assurance team has evaluated the following open source software (OSS) CVEs as they relate to PAN-OS software. While PAN-OS software may include the
CVEs: CVE-2010-1622, CVE-2015-7552, CVE-2018-16840, CVE-2019-7639, CVE-2020-17049, CVE-2020-7774, CVE-2021-0131, CVE-2021-0132, CVE-2021-0133, CVE-2021-0134, CVE-2021-4044, CVE-2021-4160, CVE-2021-41773, CVE-2022-1343, CVE-2022-21449, CVE-2022-2274, CVE-2022-22963, CVE-2022-22965, CVE-2022-24697, CVE-2022-32207, CVE-2022-3358, CVE-2022-3996, CVE-2022-40664, CVE-2022-44792, CVE-2022-44793, CVE-2023-1255, CVE-2023-22809, CVE-2023-23919, CVE-2023-3341, CVE-2023-4236, CVE-2023-4863, CVE-2023-51767
Affected products: PAN-OS
Oracle
Oracle Oracle Communications Risk Matrix: Platform (Sudo) — CVE-2023-22809
vendor_oracle·2023-07-15·CVSS 7.8
CVE-2023-22809 [HIGH] Oracle Oracle Communications Risk Matrix: Platform (Sudo) — CVE-2023-22809
Oracle Oracle Communications Risk Matrix: Platform (Sudo) vulnerability
CVE: CVE-2023-22809
CVSS: 7.8
Protocol: None
Remote exploit: No
Affected versions: Local
Advisory: cpujul2023 (JUL 2023)
Apple
CVE-2023-22809: macOS Ventura 13.4
vendor_apple·2023-05-18·CVSS 7.8
CVE-2023-22809 [HIGH] CVE-2023-22809: macOS Ventura 13.4
Apple Security Update: About the security content of macOS Ventura 13.4
Product: macOS Ventura
Version: 13.4
CVE: CVE-2023-22809
Component: CVE-2023-22809
Palo Alto
Impact of Sudo Vulnerability CVE-2023-22809
vendor_paloalto·2023-02-08·CVSS 7.8
CVE-2023-22809 [HIGH] Impact of Sudo Vulnerability CVE-2023-22809
Impact of Sudo Vulnerability CVE-2023-22809
The Palo Alto Networks Product Security Assurance team has evaluated the sudo software vulnerability CVE-2023-22809 and has determined that the following Palo Alto Networks products do not expose the sudo program and, therefore, do not offer any scenarios required for successful exploitation of this vulnerability.
Affected products: Cloud NGFW, PAN-OS, Prisma Access, Prisma SD-WAN ION
Solution: No product updates are required for this vulnerability.
Ubuntu
Sudo vulnerability
vendor_ubuntu·2023-01-30·CVSS 7.8
CVE-2023-22809 [HIGH] Sudo vulnerability
Title: Sudo vulnerability
Summary: Several security issues were fixed in Sudo.
USN-5811-1 fixed a vulnerability in Sudo. This update provides
the corresponding update for Ubuntu 14.04 ESM.
Original advisory details:
Matthieu Barjole and Victor Cutillas discovered that Sudo incorrectly
handled user-specified editors when using the sudoedit command. A local
attacker that has permission to use the sudoedit command could possibly use
this issue to edit arbitrary files. (CVE-2023-22809)
Instructions: In general, a standard system update will make all the necessary changes.
Red Hat
sudo: arbitrary file write with privileges of the RunAs user
vendor_redhat·2023-01-18·CVSS 7.8
CVE-2023-22809 [HIGH] sudo: arbitrary file write with privileges of the RunAs user
sudo: arbitrary file write with privileges of the RunAs user
In Sudo before 1.9.12p2, the sudoedit (aka -e) feature mishandles extra arguments passed in the user-provided environment variables (SUDO_EDITOR, VISUAL, and EDITOR), allowing a local attacker to append arbitrary entries to the list of files to process. This can lead to privilege escalation. Affected versions are 1.8.0 through 1.9.12.p1. The problem exists because a user-specified editor may contain a "--" argument that defeats a protection mechanism, e.g., an EDITOR='vim -- /path/to/extra/file' value.
A vulnerability was found in sudo. Exposure in how sudoedit handles user-provided environment variables leads to arbitrary file writing with privileges of the RunAs user (usually root). The prerequisite for exploitation is that t
Ubuntu
Sudo vulnerability
vendor_ubuntu·2023-01-18·CVSS 7.8
CVE-2023-22809 [HIGH] Sudo vulnerability
Title: Sudo vulnerability
Summary: Sudo could be made to possibly edit arbitrary files
if it received a specially crafted input.
USN-5811-1 fixed a vulnerability in Sudo. This update provides
the corresponding update for Ubuntu 16.04 ESM.
Original advisory details:
Matthieu Barjole and Victor Cutillas discovered that Sudo incorrectly
handled user-specified editors when using the sudoedit command. A local
attacker that has permission to use the sudoedit command could possibly use
this issue to edit arbitrary files. (CVE-2023-22809)
Instructions: In general, a standard system update will make all the necessary changes.
Ubuntu
Sudo vulnerabilities
vendor_ubuntu·2023-01-18·CVSS 5.5
CVE-2023-22809 [MEDIUM] Sudo vulnerabilities
Title: Sudo vulnerabilities
Summary: Several security issues were fixed in Sudo.
Matthieu Barjole and Victor Cutillas discovered that Sudo incorrectly
handled user-specified editors when using the sudoedit command. A local
attacker that has permission to use the sudoedit command could possibly use
this issue to edit arbitrary files. (CVE-2023-22809)
It was discovered that the Protobuf-c library, used by Sudo, incorrectly
handled certain arithmetic shifts. An attacker could possibly use this
issue to cause Sudo to crash, resulting in a denial of service. This issue
only affected Ubuntu 22.04 LTS. (CVE-2022-33070)
Instructions: In general, a standard system update will make all the necessary changes.
Microsoft
In Sudo before 1.9.12p2, the sudoedit (aka -e) feature mishandles extra arguments passed in the user-provided environment variables (SUDO_EDITOR, VISUAL, and EDITOR), allowing a local attacker to appe
vendor_msrc·2023-01-10·CVSS 7.8
CVE-2023-22809 [HIGH] CWE-269 In Sudo before 1.9.12p2, the sudoedit (aka -e) feature mishandles extra arguments passed in the user-provided environment variables (SUDO_EDITOR, VISUAL, and EDITOR), allowing a local attacker to appe
In Sudo before 1.9.12p2, the sudoedit (aka -e) feature mishandles extra arguments passed in the user-provided environment variables (SUDO_EDITOR, VISUAL, and EDITOR), allowing a local attacker to append arbitrary entries to the list of files to process. This can lead to privilege escalation. Affected versions are 1.8.0 through 1.9.12.p1. The problem exists because a user-specified editor may contain a "--" argument that defeats a protection mechanism, e.g., an EDITOR='vim -- /path/to/extra/file' value.
FAQ: Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability?
One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the most recent
Debian
CVE-2023-22809: sudo - In Sudo before 1.9.12p2, the sudoedit (aka -e) feature mishandles extra argument...
vendor_debian·2023·CVSS 7.8
CVE-2023-22809 [HIGH] CVE-2023-22809: sudo - In Sudo before 1.9.12p2, the sudoedit (aka -e) feature mishandles extra argument...
In Sudo before 1.9.12p2, the sudoedit (aka -e) feature mishandles extra arguments passed in the user-provided environment variables (SUDO_EDITOR, VISUAL, and EDITOR), allowing a local attacker to append arbitrary entries to the list of files to process. This can lead to privilege escalation. Affected versions are 1.8.0 through 1.9.12.p1. The problem exists because a user-specified editor may contain a "--" argument that defeats a protection mechanism, e.g., an EDITOR='vim -- /path/to/extra/file' value.
Scope: local
bookworm: resolved (fixed in 1.9.12p2-1)
bullseye: resolved (fixed in 1.9.5p2-3+deb11u1)
forky: resolved (fixed in 1.9.12p2-1)
sid: resolved (fixed in 1.9.12p2-1)
trixie: resolved (fixed in 1.9.12p2-1)
No detection rules found.
Exploit-DB
sudo 1.8.0 to 1.9.12p1 - Privilege Escalation
exploitdb·2023-04-03·CVSS 7.8
CVE-2023-22809 [HIGH] sudo 1.8.0 to 1.9.12p1 - Privilege Escalation
sudo 1.8.0 to 1.9.12p1 - Privilege Escalation
---
#!/usr/bin/env bash
# Exploit Title: sudo 1.8.0 to 1.9.12p1 - Privilege Escalation
# Exploit Author: n3m1.sys
# CVE: CVE-2023-22809
# Date: 2023/01/21
# Vendor Homepage: https://www.sudo.ws/
# Software Link: https://www.sudo.ws/dist/sudo-1.9.12p1.tar.gz
# Version: 1.8.0 to 1.9.12p1
# Tested on: Ubuntu Server 22.04 - vim 8.2.4919 - sudo 1.9.9
#
# Git repository: https://github.com/n3m1dotsys/CVE-2023-22809-sudoedit-privesc
#
# Running this exploit on a vulnerable system allows a localiattacker to gain
# a root shell on the machine.
#
# The exploit checks if the current user has privileges to run sudoedit or
# sudo -e on a file as root. If so it will open the sudoers file for the
# attacker to add a line to gain privileges on all the files
Metasploit
Sudoedit Extra Arguments Priv Esc
metasploit
Sudoedit Extra Arguments Priv Esc
Sudoedit Extra Arguments Priv Esc
This exploit takes advantage of a vulnerability in sudoedit, part of the sudo package. The sudoedit (aka sudo -e) feature mishandles extra arguments passed in the user-provided environment variables (SUDO_EDITOR, VISUAL, and EDITOR), allowing a local attacker to append arbitrary entries to the list of files to process. This can lead to privilege escalation. by appending extra entries on /etc/sudoers allowing for execution of an arbitrary payload with root privileges. Affected versions are 1.8.0 through 1.9.12.p1. However THIS module only works against Ubuntu 22.04 and 22.10. This module was tested against sudo 1.9.9-1ubuntu2 on Ubuntu 22.04, and 1.9.11p3-1ubuntu1 on Ubuntu 22.10.
Securelist
Exploits and vulnerabilities in Q3 2024
blogs_securelist·2024-12-06·CVSS 8.1
CVE-2024-47177 [HIGH] Exploits and vulnerabilities in Q3 2024
Table of Contents
Statistics on registered vulnerabilities
Exploitation statistics
Windows and Linux vulnerability exploitation
Most prevalent exploits
Vulnerability exploitation in APT attacks
Interesting vulnerabilities
CVE-2024-47177 (CUPS filters)
CVE-2024-38112 (MSHTML Spoofing)
CVE-2024-6387 (regreSSHion)
CVE-2024-3183 (Free IPA)
CVE-2024-45519 (Zimbra)
CVE-2024-5290 (Ubuntu wpa_supplicant)
Conclusion and advice
Authors
Alexander Kolesnikov
Q3 2024 saw multiple vulnerabilities discovered in Windows and Linux subsystems that are not standard for cyberattacks. This is because operating system developers have been releasing new security mitigations for whole sets of vulnerabilities in commonly used subsystems. For example, a log integrity check is set to appear in the Co
Securelist
Analyzing the vulnerability landscape in Q3 2024
blogs_securelist·2024-12-06·CVSS 8.1
CVE-2024-47177 [HIGH] Analyzing the vulnerability landscape in Q3 2024
Table of Contents
- Statistics on registered vulnerabilities
- Exploitation statistics
- Vulnerability exploitation in APT attacks
- Interesting vulnerabilities
- CVE-2024-47177 (CUPS filters)
- CVE-2024-38112 (MSHTML Spoofing)
- CVE-2024-6387 (regreSSHion)
- CVE-2024-3183 (Free IPA)
- CVE-2024-45519 (Zimbra)
- CVE-2024-5290 (Ubuntu wpa_supplicant)
- Conclusion and advice
Authors
- Alexander Kolesnikov
Q3 2024 saw multiple vulnerabilities discovered in Windows and Linux subsystems that are not standard for cyberattacks. This is because operating system developers have been releasing new security mitigations for whole sets of vulnerabilities in commonly used subsystems. For example, a log integrity check is set to appear in the Common Log Filing System (CLFS) in Windows, so the number
Checkpoint
3rd April – Threat Intelligence Report
blogs_checkpoint·2023-04-03·CVSS 7.8
CVE-2023-29059 [HIGH] 3rd April – Threat Intelligence Report
Latest Publications
CPR Podcast Channel
AI Research
Web 3.0 Security
Intelligence Reports
ThreatCloud AI
Threat Intelligence & Research
Zero Day Protection
Sandblast File Analysis
About Us
SUBSCRIBE
2026
2025
2024
2023
2022
2021
2020
2019
2018
2017
2016
## 3rd April – Threat Intelligence Report
For the latest discoveries in cyber research for the week of 3rd April, please download our Threat_Intelligence Bulletin
TOP ATTACKS AND BREACHES
Both Windows and macOS versions of 3CXDesktopApp, a VoIP application of 3CX Communications Company , were compromised and used to distribute Trojanized versions in a large-scale supply chain attack. In this widespread campaign, dubbed SmoothOperator, threat actors have misused 3CX’s application with a malicious file that is loade
arXiv
KnowHow: Automatically Applying High-Level CTI Knowledge for Interpretable and Accurate Provenance Analysis
arxiv_fulltext·2025-09-06
KnowHow: Automatically Applying High-Level CTI Knowledge for Interpretable and Accurate Provenance Analysis
KnowHow: Automatically Applying High-Level CTI Knowledge for Interpretable and Accurate Provenance Analysis
Yuhan Meng2,
Shaofei Li2,
Jiaping Gui3,
Peng Jiang4,
and Ding Li* is the corresponding author.21
2Key Laboratory of High-Confidence Software Technologies (MOE), School of Computer Science, Peking University
3School of Computer Science, Shanghai Jiao Tong University, 4Southeast University
2\mengyuhan, lishaofei, ding_li\@pku.edu.cn, [email protected], [email protected]
\@IEEEpubidpullup6.5
Network and Distributed System Security (NDSS) Symposium 2026
23 - 27 February 2026 , San Diego, CA, USA
ISBN 979-8-9919276-8-0
https://dx.doi.org/10.14722/yyy.2026.[23|24]xxx
www.ndss-symposium.org
[ ]
\@IEEEpubidpullup6.5
Network and Distributed System Security (NDSS) Symposium 2026
CTF
Agile / README
ctf_writeups·CVSS 7.8
[HIGH] Agile / README
# Agile - HackTheBox - Writeup
Linux, 30 Base Points, Medium
## Machine
## TL;DR
To solve this machine, we start by using `nmap` to enumerate open services and find ports `22`, and `80`.
***User 1***: Discovered a Local File Inclusion (LFI) vulnerability on the Export API. Additionally, detected the presence of a debug console on the error page. By successfully cracking the Flask Werkzeug console PIN, gained access as the `www-data` user and established a reverse shell. Furthermore, uncovered database credentials and retrieved the password for the `corum` user.
***User 2***: Identified the presence of Chrome remote port debugging. Leveraged an SSH tunnel to access this port and encountered the SuperPassword page. Upon clicking on Vault, discovered the credentials associated with th
http://packetstormsecurity.com/files/171644/sudo-1.9.12p1-Privilege-Escalation.htmlhttp://packetstormsecurity.com/files/172509/Sudoedit-Extra-Arguments-Privilege-Escalation.htmlhttp://packetstormsecurity.com/files/174234/Cisco-ThousandEyes-Enterprise-Agent-Virtual-Appliance-Arbitrary-File-Modification.htmlhttp://seclists.org/fulldisclosure/2023/Aug/21http://www.openwall.com/lists/oss-security/2023/01/19/1https://lists.debian.org/debian-lts-announce/2023/01/msg00012.htmlhttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2QDGFCGAV5QRJCE6IXRXIS4XJHS57DDH/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/G4YNBTTKTRT2ME3NTSXAPTOKYUE47XHZ/https://security.gentoo.org/glsa/202305-12https://security.netapp.com/advisory/ntap-20230127-0015/https://support.apple.com/kb/HT213758https://www.debian.org/security/2023/dsa-5321https://www.sudo.ws/security/advisories/sudoedit_any/https://www.synacktiv.com/sites/default/files/2023-01/sudo-CVE-2023-22809.pdfhttp://packetstormsecurity.com/files/171644/sudo-1.9.12p1-Privilege-Escalation.htmlhttp://packetstormsecurity.com/files/172509/Sudoedit-Extra-Arguments-Privilege-Escalation.htmlhttp://packetstormsecurity.com/files/174234/Cisco-ThousandEyes-Enterprise-Agent-Virtual-Appliance-Arbitrary-File-Modification.htmlhttp://seclists.org/fulldisclosure/2023/Aug/21http://www.openwall.com/lists/oss-security/2023/01/19/1https://lists.debian.org/debian-lts-announce/2023/01/msg00012.htmlhttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2QDGFCGAV5QRJCE6IXRXIS4XJHS57DDH/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/G4YNBTTKTRT2ME3NTSXAPTOKYUE47XHZ/https://security.gentoo.org/glsa/202305-12https://security.netapp.com/advisory/ntap-20230127-0015/https://support.apple.com/kb/HT213758https://www.debian.org/security/2023/dsa-5321https://www.sudo.ws/security/advisories/sudoedit_any/https://www.synacktiv.com/sites/default/files/2023-01/sudo-CVE-2023-22809.pdf
2023-01-18
Published
Exploited in the wild