CVE-2019-14287

HIGH NUCLEI

Sudo <1.8.28 - Privilege Escalation

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 28 public exploits for CVE-2019-14287. PoCs published by Mohin Paramasivam, n0w4n, CMNatic. A Nuclei detection template is also available.

AI-analyzed exploit summary This exploit leverages a sudo vulnerability (CVE-2019-14287) where passing `-u#-1` bypasses user ID validation, allowing execution of commands as root. The script automates the process by checking sudo permissions and executing the target binary with the malicious user ID.

Description

In Sudo before 1.8.28, an attacker with access to a Runas ALL sudoer account can bypass certain policy blacklists and session PAM modules, and can cause incorrect logging, by invoking sudo with a crafted user ID. For example, this allows bypass of !root configuration, and USER= logging, for a "sudo -u \#$((0xffffffff))" command.

Exploits (28)

exploitdb WORKING POC
by Mohin Paramasivam · pythonlocallinux
https://www.exploit-db.com/exploits/47502

This exploit leverages a sudo vulnerability (CVE-2019-14287) where passing `-u#-1` bypasses user ID validation, allowing execution of commands as root. The script automates the process by checking sudo permissions and executing the target binary with the malicious user ID.

Classification
Working Poc 95%
Attack Type
Lpe
Complexity
Trivial
Reliability
Reliable
Target: sudo <1.8.28
Auth required
Prerequisites: User must have sudo privileges with a binary allowed (e.g., /bin/bash) · Target system must be running sudo <1.8.28
devstral-2 · analyzed Feb 16, 2026 Full analysis →
nomisec WORKING POC 12 stars
by n0w4n · poc
https://github.com/n0w4n/CVE-2019-14287

This repository contains a functional exploit script for CVE-2019-14287, a sudo security bypass vulnerability. The script checks for a vulnerable sudo version and attempts to exploit it by running a command as user ID -1, which can lead to privilege escalation.

Classification
Working Poc 90%
Attack Type
Lpe
Complexity
Trivial
Reliability
Reliable
Target: sudo versions before 1.8.28
Auth required
Prerequisites: User with sudo permissions (non-ALL) on a vulnerable sudo version
devstral-2 · analyzed Feb 18, 2026 Full analysis →
nomisec WORKING POC 7 stars
by CMNatic · poc
https://github.com/CMNatic/Dockerized-CVE-2019-14287

This repository provides a Dockerized environment to demonstrate CVE-2019-14287, a sudo vulnerability allowing privilege escalation to root. The Dockerfile sets up a vulnerable Ubuntu 18.04 container with a misconfigured sudoers file, enabling exploitation of the flaw.

Classification
Working Poc 90%
Attack Type
Lpe
Complexity
Trivial
Reliability
Reliable
Target: sudo versions under 1.8.28
Auth required
Prerequisites: Docker environment · SSH access to the container
devstral-2 · analyzed Feb 18, 2026 Full analysis →
nomisec WORKING POC 3 stars
by shallvhack · poc
https://github.com/shallvhack/Sudo-Security-Bypass-CVE-2019-14287

This repository contains a functional Bash script that exploits CVE-2019-14287, a sudo security bypass vulnerability. The script checks for vulnerable sudo versions and attempts to bypass policy restrictions by invoking sudo with a crafted user ID.

Classification
Working Poc 95%
Attack Type
Auth Bypass
Complexity
Trivial
Reliability
Reliable
Target: Sudo before 1.8.28
Auth required
Prerequisites: Access to a system with vulnerable sudo version · User with sudo privileges (not necessarily ALL)
devstral-2 · analyzed Feb 18, 2026 Full analysis →
nomisec WORKING POC 1 stars
by MariliaMeira · poc
https://github.com/MariliaMeira/CVE-2019-14287

This exploit leverages a sudo vulnerability (CVE-2019-14287) where passing `-u#-1` bypasses user ID validation, allowing execution of commands as root. The PoC automates the process by checking sudo permissions and executing the target binary with the malicious user ID.

Classification
Working Poc 95%
Attack Type
Lpe
Complexity
Trivial
Reliability
Reliable
Target: sudo <1.8.28
Auth required
Prerequisites: User must have sudo privileges with a binary allowed (e.g., /bin/bash)
devstral-2 · analyzed Feb 18, 2026 Full analysis →
nomisec WORKING POC 1 stars
by CashWilliams · poc
https://github.com/CashWilliams/CVE-2019-14287-demo

This repository provides a Docker container demonstrating CVE-2019-14287, a sudo vulnerability allowing privilege escalation via user ID manipulation. The PoC shows how a non-root user (alice) can execute commands as root by exploiting the '-u#-1' argument.

Classification
Working Poc 95%
Attack Type
Lpe
Complexity
Trivial
Reliability
Reliable
Target: sudo 1.8.21p2-3ubuntu1
Auth required
Prerequisites: Access to a system with vulnerable sudo version · User with sudo privileges (but restricted from root)
devstral-2 · analyzed Feb 18, 2026 Full analysis →
nomisec WRITEUP 1 stars
by FauxFaux · poc
https://github.com/FauxFaux/sudo-cve-2019-14287

This repository contains a patch and source code analysis for CVE-2019-14287, a vulnerability in sudo related to environment variable handling. The provided files include patches and modified source code for the sudoers plugin, specifically focusing on the env.c file.

Classification
Writeup 90%
Attack Type
Lpe
Complexity
Moderate
Reliability
Reliable
Target: sudo (versions prior to 1.8.28)
Auth required
Prerequisites: Access to a system with vulnerable sudo version · User privileges to execute sudo commands
devstral-2 · analyzed Feb 18, 2026 Full analysis →
nomisec WORKING POC
by HivinManjuSri · poc
https://github.com/HivinManjuSri/ubuntu-cve-2019-14287-patch-manager

This repository provides a GUI-based tool for detecting, mitigating, and verifying protection against CVE-2019-14287, a sudo privilege escalation vulnerability. It includes scripts to check system status, apply patches, and scan sudoers files for risky configurations.

Classification
Working Poc 95%
Attack Type
Lpe
Complexity
Moderate
Reliability
Reliable
Target: sudo (versions affected by CVE-2019-14287)
Auth required
Prerequisites: sudo access · Ubuntu 19.04 or similar environment
devstral-2 · analyzed Apr 25, 2026 Full analysis →
github WRITEUP
by Zahid-secure · poc
https://github.com/Zahid-secure/cve-walkthrough-labs/tree/main/2019/CVE-2019-14287-AgentSudo-tryhackme

This is a detailed technical walkthrough of the Agent Sudo TryHackMe challenge, covering reconnaissance, enumeration, exploitation, and privilege escalation via CVE-2019-14287. It includes step-by-step commands, tool usage, and an explanation of the sudo logic flaw.

Classification
Writeup 100%
Attack Type
Lpe
Complexity
Moderate
Reliability
Reliable
Target: sudo (versions before 1.8.28)
Auth required
Prerequisites: valid user credentials · access to vulnerable sudo binary
devstral-2 · analyzed Mar 14, 2026 Full analysis →
nomisec WORKING POC
by h3x0v3rl0rd · poc
https://github.com/h3x0v3rl0rd/CVE-2019-14287

This repository contains a functional exploit script for CVE-2019-14287, a sudo vulnerability that allows local privilege escalation by exploiting a user ID overflow. The script checks for vulnerable sudo versions and attempts to exploit the flaw if conditions are met.

Classification
Working Poc 90%
Attack Type
Lpe
Complexity
Trivial
Reliability
Reliable
Target: sudo versions < 1.8.28
Auth required
Prerequisites: Local user access · Sudo permissions (not necessarily ALL)
devstral-2 · analyzed Feb 18, 2026 Full analysis →
nomisec WORKING POC
by lemonadern · poc
https://github.com/lemonadern/poc-cve-2019-14287

This repository provides a Docker-based proof-of-concept for CVE-2019-14287, a sudo vulnerability allowing privilege escalation by exploiting incorrect handling of user IDs (specifically, using -1 or 4294967295 to bypass authentication and execute commands as root).

Classification
Working Poc 100%
Attack Type
Lpe
Complexity
Trivial
Reliability
Reliable
Target: sudo versions before 1.8.28
No auth needed
Prerequisites: Docker environment · vulnerable sudo version installed
devstral-2 · analyzed Feb 18, 2026 Full analysis →
nomisec SUSPICIOUS
by Hasintha-98 · poc
https://github.com/Hasintha-98/Sudo-Vulnerability-Exploit-CVE-2019-14287

The repository contains a vague README with no actual exploit code or technical details about CVE-2019-14287. It describes the vulnerability in generic terms without providing actionable information or proof-of-concept code.

Classification
Suspicious 90%
Attack Type
Auth Bypass
Complexity
Theoretical
Reliability
Theoretical
Target: sudo (versions affected by CVE-2019-14287)
Auth required
Prerequisites: Non-standard sudo configuration allowing user ID -1 or # -1
devstral-2 · analyzed Feb 18, 2026 Full analysis →
nomisec STUB
by DularaAnushka · poc
https://github.com/DularaAnushka/Linux-Privilege-Escalation-using-Sudo-Rights

The repository contains only a README with a title and CVE reference, lacking any functional exploit code or technical details. It appears to be a placeholder or incomplete submission.

Classification
Stub 90%
Attack Type
Lpe
Complexity
Theoretical
Reliability
Theoretical
Target: sudo (versions affected by CVE-2019-14287)
Auth required
Prerequisites: sudo rights misconfiguration
devstral-2 · analyzed Feb 18, 2026 Full analysis →
nomisec WORKING POC
by edsonjt81 · poc
https://github.com/edsonjt81/CVE-2019-14287-

This repository contains a functional exploit script for CVE-2019-14287, a sudo security bypass vulnerability. The script checks for a vulnerable sudo version and attempts to exploit it by running a command as user ID -1, which sudo incorrectly treats as root.

Classification
Working Poc 90%
Attack Type
Lpe
Complexity
Trivial
Reliability
Reliable
Target: sudo versions before 1.8.28
Auth required
Prerequisites: User with sudo permissions (non-ALL) · Vulnerable sudo version (< 1.8.28)
devstral-2 · analyzed Feb 18, 2026 Full analysis →
nomisec WORKING POC
by M108Falcon · poc
https://github.com/M108Falcon/Sudo-CVE-2019-14287

This repository contains functional exploit scripts (Python and Bash) for CVE-2019-14287, a sudo vulnerability allowing local privilege escalation by exploiting incorrect user ID handling. The scripts verify sudo version and execute the exploit if conditions are met.

Classification
Working Poc 95%
Attack Type
Lpe
Complexity
Trivial
Reliability
Reliable
Target: sudo < 1.8.28
Auth required
Prerequisites: Local user access · Sudo rights (not necessarily ALL)
devstral-2 · analyzed Feb 18, 2026 Full analysis →
nomisec STUB
by HussyCool · poc
https://github.com/HussyCool/CVE-2019-14287-IT18030372-

The repository contains only a minimal README with a CVE title and no functional exploit code or technical details. It appears to be a placeholder or incomplete submission.

Classification
Stub 90%
Attack Type
Other
Complexity
Trivial
Reliability
Theoretical
Target: Sudo (version not specified)
No auth needed
devstral-2 · analyzed Feb 18, 2026 Full analysis →
nomisec WORKING POC
by axax002 · poc
https://github.com/axax002/sudo-vulnerability-CVE-2019-14287

This repository contains a functional exploit for CVE-2019-14287, a sudo vulnerability that allows local privilege escalation by exploiting a user ID parsing flaw. The exploit checks the sudo version, tests the vulnerability, and spawns a root shell if successful.

Classification
Working Poc 95%
Attack Type
Lpe
Complexity
Trivial
Reliability
Reliable
Target: sudo versions before 1.8.28
Auth required
Prerequisites: Local access to a vulnerable system · sudo installed and configured
devstral-2 · analyzed Feb 18, 2026 Full analysis →
nomisec WRITEUP
by huang919 · poc
https://github.com/huang919/cve-2019-14287-PPT

The repository contains technical documentation and references related to CVE-2019-14287, a sudo privilege escalation vulnerability. It includes explanations and external references but lacks functional exploit code.

Classification
Writeup 60%
Attack Type
Lpe
Complexity
Moderate
Reliability
Theoretical
Target: sudo (versions affected by CVE-2019-14287)
Auth required
Prerequisites: Local access to the target system · Misconfigured sudoers file
devstral-2 · analyzed Feb 18, 2026 Full analysis →
nomisec WRITEUP
by gurneesh · poc
https://github.com/gurneesh/CVE-2019-14287-write-up

This repository provides a technical write-up demonstrating CVE-2019-14287, a sudo vulnerability where a user can bypass restrictions by exploiting a user ID overflow (e.g., -u#-1 or -u#4294967295) to execute commands as root. The steps include creating a restricted user and demonstrating the bypass.

Classification
Writeup 90%
Attack Type
Lpe
Complexity
Trivial
Reliability
Reliable
Target: sudo (versions before 1.8.28)
Auth required
Prerequisites: Access to a system with vulnerable sudo version · Ability to create a restricted user
devstral-2 · analyzed Feb 18, 2026 Full analysis →

Nuclei Templates (1)

Sudo <= 1.8.27 - Security Bypass
HIGHVERIFIEDby daffainfo

References (37)

Core 37
Core References
Exploit, Mailing List, Third Party Advisory mailing-list x_refsource_mlist
http://www.openwall.com/lists/oss-security/2019/10/14/1
Third Party Advisory vendor-advisory x_refsource_debian
https://www.debian.org/security/2019/dsa-4543
Issue Tracking, Mailing List, Third Party Advisory mailing-list x_refsource_bugtraq
https://seclists.org/bugtraq/2019/Oct/21
Issue Tracking, Mailing List, Third Party Advisory mailing-list x_refsource_bugtraq
https://seclists.org/bugtraq/2019/Oct/20
Mailing List, Third Party Advisory vendor-advisory x_refsource_suse
http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00042.html
Exploit, Vendor Advisory x_refsource_confirm
https://www.sudo.ws/alerts/minus_1_uid.html
Mailing List, Third Party Advisory vendor-advisory x_refsource_suse
http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00047.html
Third Party Advisory x_refsource_confirm
https://security.netapp.com/advisory/ntap-20191017-0003/
Mailing List, Patch, Third Party Advisory mailing-list x_refsource_mlist
https://www.openwall.com/lists/oss-security/2019/10/15/2
Mailing List, Third Party Advisory mailing-list x_refsource_mlist
https://lists.debian.org/debian-lts-announce/2019/10/msg00022.html
Mailing List, Third Party Advisory mailing-list x_refsource_mlist
http://www.openwall.com/lists/oss-security/2019/10/24/1
Third Party Advisory vendor-advisory x_refsource_redhat
https://access.redhat.com/errata/RHSA-2019:3197
Third Party Advisory vendor-advisory x_refsource_redhat
https://access.redhat.com/errata/RHSA-2019:3205
Third Party Advisory vendor-advisory x_refsource_redhat
https://access.redhat.com/errata/RHSA-2019:3204
Third Party Advisory vendor-advisory x_refsource_redhat
https://access.redhat.com/errata/RHSA-2019:3209
Third Party Advisory vendor-advisory x_refsource_redhat
https://access.redhat.com/errata/RHSA-2019:3219
Mailing List, Third Party Advisory mailing-list x_refsource_mlist
http://www.openwall.com/lists/oss-security/2019/10/29/3
Third Party Advisory vendor-advisory x_refsource_redhat
https://access.redhat.com/errata/RHSA-2019:3278
Third Party Advisory vendor-advisory x_refsource_redhat
https://access.redhat.com/errata/RHSA-2019:3694
Third Party Advisory vendor-advisory x_refsource_redhat
https://access.redhat.com/errata/RHSA-2019:3755
Third Party Advisory vendor-advisory x_refsource_redhat
https://access.redhat.com/errata/RHSA-2019:3754
Third Party Advisory vendor-advisory x_refsource_redhat
https://access.redhat.com/errata/RHSA-2019:3895
Third Party Advisory vendor-advisory x_refsource_redhat
https://access.redhat.com/errata/RHSA-2019:3916
Third Party Advisory vendor-advisory x_refsource_redhat
https://access.redhat.com/errata/RHBA-2019:3248
Third Party Advisory vendor-advisory x_refsource_redhat
https://access.redhat.com/errata/RHSA-2019:3941
Third Party Advisory vendor-advisory x_refsource_redhat
https://access.redhat.com/errata/RHSA-2019:4191
Third Party Advisory vendor-advisory x_refsource_redhat
https://access.redhat.com/errata/RHSA-2020:0388
Third Party Advisory vendor-advisory x_refsource_gentoo
https://security.gentoo.org/glsa/202003-12
Mailing List, Third Party Advisory mailing-list x_refsource_mlist
http://www.openwall.com/lists/oss-security/2021/09/14/2
Third Party Advisory vendor-advisory x_refsource_ubuntu
https://usn.ubuntu.com/4154-1/

Scores

CVSS v3 8.8
EPSS 0.6392
EPSS Percentile 99.1%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Details

CWE
CWE-755
Status published
Products (47)
canonical/ubuntu_linux 12.04
canonical/ubuntu_linux 14.04
canonical/ubuntu_linux 16.04
canonical/ubuntu_linux 18.04
canonical/ubuntu_linux 19.04
debian/debian_linux 8.0
debian/debian_linux 9.0
debian/debian_linux 10.0
fedoraproject/fedora 29
fedoraproject/fedora 30
... and 37 more
Published Oct 17, 2019
Tracked Since Feb 18, 2026