Publish GHSA-98cv-wqjx-wx8f

2026-05-22 18:04:22 -07:00 · 2025-05-13 14:09:41 +00:00
parent 3066f8cd10
commit 48e8038f6f
1 changed files with 68 additions and 0 deletions
@@ -0,0 +1,68 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-98cv-wqjx-wx8f",
+  "modified": "2025-05-13T14:08:18Z",
+  "published": "2025-05-13T14:08:18Z",
+  "aliases": [
+    "CVE-2025-46717"
+  ],
+  "summary": "sudo-rs Allows Low Privilege Users to Discover the Existence of Files in Inaccessible Folders",
+  "details": "### Summary\n\nUsers with no (or very limited) sudo privileges can determine whether files exists in folders that they otherwise cannot access using `sudo --list <pathname>`.\n\n### PoC\n\nAs root:\n```\n# mkdir /tmp/foo\n# chmod a-rwx /tmp/foo\n# touch /tmp/foo/secret_file\n```\nAs a user without any (or limited) sudo rights:\n```\n$ sudo --list /tmp/foo/nonexistent_file\nsudo-rs: '/tmp/foo/nonexistent_file': command not found\n$ $ sudo --list /tmp/foo/secret_file\nsudo-rs: Sorry, user eve may not run sudo on host.\n```\nI.e. the user can distinguish whether files exist.\n\n### Related\nOriginal sudo (vulnerable version tested by us: 1.9.15p5) exhibited similar behaviour for files with the executable bit set.\n\n### Impact\nUsers with local access to a machine can discover the existence/non-existence of certain files, revealing potentially sensitive information in the file names. This information can also be used in conjunction with other attacks.\n\n### Credits\nThis issue was identified by sudo-rs developer Marc Schoolderman",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
+    }
+  ],
+  "affected": [
+    {
+      "package": {
+        "ecosystem": "crates.io",
+        "name": "sudo-rs"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "0"
+            },
+            {
+              "fixed": "0.2.6"
+            }
+          ]
+        }
+      ],
+      "database_specific": {
+        "last_known_affected_version_range": "<= 0.2.5"
+      }
+    }
+  ],
+  "references": [
+    {
+      "type": "WEB",
+      "url": "https://github.com/trifectatechfoundation/sudo-rs/security/advisories/GHSA-98cv-wqjx-wx8f"
+    },
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-46717"
+    },
+    {
+      "type": "PACKAGE",
+      "url": "https://github.com/trifectatechfoundation/sudo-rs"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/trifectatechfoundation/sudo-rs/releases/tag/v0.2.6"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-497"
+    ],
+    "severity": "LOW",
+    "github_reviewed": true,
+    "github_reviewed_at": "2025-05-13T14:08:18Z",
+    "nvd_published_at": "2025-05-12T15:16:01Z"
+  }
+}