H3-2021-0039

Unrestricted Sudo Privileges

Description

An unrestricted sudo privileges weakness was found on a host. This weakness allows certain non-root users to execute any command on the system as the root user, without requiring a password each time they attempt to use sudo. Specifically, the issue can be exploited if the sudoers file is misconfigured to include entries like "user1 ALL=(ALL) NOPASSWD: ALL," allowing the specified user to run all commands without being prompted for their password.

Impact

An attacker exploiting this weakness can gain full administrative control over the affected system, potentially allowing them to execute arbitrary malicious commands, alter system configurations, and access sensitive data.

References

• How to Edit the Sudoers File
• MITRE ATT&CK Technique: T1548.003: Abuse Elevation Control Mechanism: Sudo and Sudo Caching