A new proof-of-concept (PoC) exploit has been published for a critical flaw in the widely used sudo utility. This vulnerability enables any local user to escape a chroot jail and execute commands with root privileges. Organizations relying on sudo are urged to audit and update their installations immediately. Chroot Escape Enables Root Access The flaw resides in sudo’s handling of […]
A recent surge in threat actors leveraging remote management and monitoring (RMM) tools for initial access has intensified scrutiny of platforms once reserved for legitimate IT administration. While AnyDesk has waned in popularity among adversaries due to improved detection, ConnectWise ScreenConnect has emerged as a preferred option for stealthy intrusion, persistence, and lateral movement. This […]
A critical vulnerability in the widely used Sudo utility has come under scrutiny following the public release of a proof-of-concept exploit, raising alarms for Linux system administrators worldwide.
CVE-2025-32463 targets the chroot feature in Sudo versions 1.9.14 through 1.9.17, enabling local attackers to escalate privileges to root level with minimal effort.
Discovered by security researcher Rich Mirch, this flaw exploits how Sudo handles user-specified root directories, potentially allowing unauthorized command execution as the superuser.
The issue, rated at a CVSS score of 9.3, critical, underscores ongoing risks in privilege management tools essential to Unix-like operating systems.
Reports indicate active exploitation in the wild, prompting urgent calls for patching from organizations like CISA.
This development arrives amid a surge in Sudo-related vulnerabilities, highlighting the tool’s persistent role as a prime target for attackers seeking deeper system access.
The vulnerability stems from Sudo’s improper resolution of paths when using the –chroot option, introduced in version 1.9.14 to support user-defined root environments.
In affected versions, an attacker can craft a malicious /etc/nsswitch.conf file within a controlled directory, tricking Sudo into loading an arbitrary shared library during command evaluation.
This bypasses sudoers file restrictions, granting root privileges even to users not explicitly authorized for escalation.
Rich Mirch identified the issue through analysis of Sudo’s path resolution logic, noting that the chroot feature’s implementation creates an error-prone vector for local privilege escalation.
The flaw does not require network access or high privileges, making it particularly dangerous in multi-user environments like servers and development machines.
Stratascale’s advisory details how this could lead to full system compromise, including data exfiltration or malware deployment.
Ubuntu and Red Hat have confirmed the vulnerability affects their distributions, with patches rolled out in recent updates.
Proof Of Concept Demonstration
The GitHub repository by researcher kh4sh3i provides a straightforward PoC exploit, demonstrating the escalation in a controlled setting.
Users clone the repository, navigate to the directory, and make the exploit.sh script executable, and run it after checking their initial user ID.
The script leverages the chroot option to manipulate Sudo’s environment, resulting in a successful privilege gain as evidenced by the post-execution ID output showing root access.
Terminal screenshots in the repo illustrate the process: starting as a low-privilege user in the lowuser group, the exploit executes via sudo, flipping the context to root@test with full administrative capabilities.
PoC Exploit
This visual proof, mirroring the attached demonstration image, confirms the vulnerability’s reliability on unpatched systems.
While intended for educational use, the PoC emphasizes the need for caution, as unauthorized deployment constitutes illegal activity. Exploit-DB hosts a similar script, underscoring the ease of adaptation for malicious purposes.
Systems running vulnerable Sudo versions face severe risks, including complete takeover by local threat actors, which could facilitate lateral movement in breached networks.
Affected products span major Linux distributions: Ubuntu 24.04 LTS, 24.10, and 25.04; Red Hat Enterprise Linux variants; and Debian-based setups with Sudo 1.9.14-1.9.17.
Legacy versions before 1.9.14 remain unaffected due to the absence of chroot support. Immediate mitigation involves updating to Sudo 1.9.17p1 or later, where the feature is deprecated and the path resolution flaw is reverted.
Administrators should enable AppArmor or SELinux profiles to constrain Sudo operations and monitor logs for suspicious chroot invocations.
CISA has added this CVE to its Known Exploited Vulnerabilities catalog, mandating federal agencies to apply patches by October 2025.
Aspect
Details
CVE ID
CVE-2025-32463
CVSS v3.1 Score
9.3 (Critical)
Attack Vector
Local
Impact
High Confidentiality, Integrity, Availability
Affected Versions
Sudo 1.9.14 – 1.9.17
Patched Versions
1.9.17p1+
Organizations delaying updates risk heightened exposure, especially in cloud and containerized environments reliant on Sudo for automation.
Cybersecurity researchers have identified several malicious packages across npm, Python, and Ruby ecosystems that leverage Discord as a command-and-control (C2) channel to transmit stolen data to actor-controlled webhooks.
Webhooks on Discord are a way to post messages to channels in the platform without requiring a bot user or authentication, making them an attractive mechanism for attackers to
Elastic has disclosed a critical vulnerability in its Elastic Cloud Enterprise (ECE) platform that allows administrators with malicious intent to execute arbitrary commands and exfiltrate sensitive data.
Tracked as CVE-2025-37729 under advisory ESA-2025-21, the flaw stems from improper neutralization of special elements in the Jinjava template engine.
This issue affects multiple versions of ECE, potentially exposing enterprise environments to severe risks if exploited by insiders or compromised admin accounts.
The vulnerability arises when specially crafted strings containing Jinjava variables are evaluated during the processing of deployment plans in the ECE admin console.
Attackers with admin privileges can inject malicious payloads into these plans, leading to code execution. The results of such executions can then be read back through ingested logs, enabling data theft or further system compromise.
Elastic emphasizes that exploitation requires access to the admin console and a deployment with the Logging+Metrics feature enabled, narrowing the threat vector to privileged users but amplifying the impact in shared or multi-tenant setups.
Elastic Cloud Enterprise Vulnerability
This flaw impacts ECE versions from 2.5.0 up to and including 3.8.1, as well as versions 4.0.0 through 4.0.1.
Organizations running these builds in production face heightened exposure, particularly those leveraging ECE for scalable cloud management in logging and metrics workloads.
The CVSS v3.1 score of 9.1 underscores its criticality, with a vector of AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H, indicating network accessibility, low complexity, high privileges required, but scope change enabling high confidentiality, integrity, and availability impacts.
While no proof-of-concept exploits have been publicly released, the advisory details how attackers could craft payloads like those mimicking interpreter commands.
For instance, injecting strings that evaluate Jinjava expressions could trigger remote code execution, similar to template injection attacks seen in other platforms.
Elastic notes that the issue does not affect standalone Elastic Stack components but is specific to ECE’s enterprise deployment orchestration.
Mitigations
Elastic urges immediate upgrades to patched versions 3.8.2 or 4.0.2, which address the neutralization flaw in the template engine.
For those unable to patch promptly, no direct workarounds exist, though organizations can limit admin console access through strict role-based controls and monitoring.
To detect potential exploitation, Elastic recommends scanning request logs with the query: (payload.name : int3rpr3t3r or payload.name : forPath). This can flag suspicious activity indicative of injected payloads.
Indicator of Compromise
Description
Detection Method
payload.name : int3rpr3t3r
Malicious payload mimicking interpreter commands
Log search in ECE console
payload.name : forPath
Injection targeting path evaluation in templates
Log search in ECE console
As enterprises increasingly rely on ECE for hybrid cloud observability, this vulnerability highlights the need for vigilant privilege management.
Elastic’s rapid disclosure allows proactive defense, but delayed patching could invite insider threats or lateral movement in breached networks.
Ivanti has disclosed 13 vulnerabilities in Ivanti Endpoint Manager (EPM), including two high-severity issues that could enable privilege escalation and remote code execution, and eleven medium-severity SQL injection flaws. While there is no evidence of in-the-wild exploitation, Ivanti urges customers to move to the latest supported release and apply recommended mitigations as patches are still […]
As cybercrime continues to evolve, new adversaries and innovative tactics challenge defenders daily. The recently emerged threat group TA585 exemplifies this shift, deploying sophisticated malware campaigns that highlight the changing nature of the cybercrime landscape. TA585’s operational strategy, infrastructure control, and malware preferences set it apart—particularly in its use of the advanced MonsterV2 malware. TA585 […]
A new evolution is underway in the Russian cybercrime ecosystem: market operators and threat actors are rapidly shifting from selling compromised Remote Desktop Protocol (RDP) access to trading malware stealer logs for unauthorized system entry.
This transition marks a significant change in both tactics and impact within the underground forums, affecting organizations and individuals worldwide.
Historically, RDP access sales dominated Russian cybercrime marketplaces, granting threat actors direct entry into corporate and government networks. However, the emergence of advanced stealer malware—such as RedLine, Raccoon, and Vidar—has transformed illicit trading.
Instead of selling static credentials, criminals now collect and broker “logs”: raw output from malware infections containing browser-saved passwords, cookies, autofill data, crypto wallet details, and session tokens.
List of bots for sale on Russian Market (Source – Rapid7)
These leaked logs allow opportunistic access to targeted environments, sometimes with greater reach and stealth than traditional RDP sales.
Rapid7 researchers observed this shift, highlighting how stealer-log packs frequently appear on prominent Russian forums—often bundled with automated scripts to facilitate credential extraction and exploitation.
This paradigm empowers attackers to bypass network-level controls and immediately impersonate victims in varied platforms, ramping up the risk for quick account takeover and data theft.
Most common infostealers used by Russian Market sellers since 2021 (Source – Rapid7)
The scale and automation found within stealer log trading deeply challenges conventional security measures: as soon as the logs are posted, a wide array of criminals races to monetize or further weaponize the data.
Infection Mechanism
Modern stealer malware operates with remarkable efficiency. Once deployed—typically via phishing campaigns, poisoned software downloads, or malicious ads—the executable promptly scans for stored credentials, cookies, and wallets across browsers and desktop applications.
During its runtime, the stealer utilizes process injection and API calls (notably, accessing browser SQLite databases and reading credential stores).
Persistence tactics are minimal—attackers focus on short-lived infection and swift extraction, sometimes removing the malware after log harvesting to evade detection.
By the time the compromised user’s security tools identify the stealer, credentials have often already been posted to forums, making account recovery difficult.
Cyber defenders must pivot toward real-time log monitoring, multi-factor authentication, and rapid incident response to counteract this versatile and scalable model embraced by Russian cybercriminals.
Follow us on Google News, LinkedIn, and X to Get More Instant Updates, Set CSN as a Preferred Source in Google.
Elastic has released a critical security update for Elastic Cloud Enterprise (ECE) addressing a template engine injection flaw that could allow attackers with admin privileges to execute arbitrary commands and exfiltrate sensitive data. Tracked as CVE-2025-37729 and rated CVSS 9.1 (Critical), the issue affects ECE versions 2.5.0 through 3.8.1 and 4.0.0 through 4.0.1. Users are […]
A significant data exposure incident has affected the cloud-based invoicing platform Invoicely, potentially compromising sensitive information belonging to customers worldwide. The exposed database contained 178,519 files in various formats including Excel spreadsheets, CSV files, PDFs, and images. Most concerning was the complete lack of security measures – the database was neither password-protected nor encrypted, making […]
.webp)
.webp)