CVE-2022-37705

MEDIUM

Amanda 3.5.1 - Privilege Escalation via runtar SUID Argument Injection

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for CVE-2022-37705. PoCs published by MaherAzzouzi.

AI-analyzed exploit summary The repository contains a functional exploit for CVE-2022-37705, demonstrating a privilege escalation flaw in Amanda 3.5.1's runtar SUID binary. The exploit leverages flawed argument checking to execute arbitrary commands as root via the --checkpoint-action parameter.

Description

A privilege escalation flaw was found in Amanda 3.5.1 in which the backup user can acquire root privileges. The vulnerable component is the runtar SUID program, which is a wrapper to run /usr/bin/tar with specific arguments that are controllable by the attacker. This program mishandles the arguments passed to tar binary (it expects that the argument name and value are separated with a space; however, separating them with an equals sign is also supported),

Exploits (1)

nomisec WORKING POC 3 stars
by MaherAzzouzi · poc
https://github.com/MaherAzzouzi/CVE-2022-37705

The repository contains a functional exploit for CVE-2022-37705, demonstrating a privilege escalation flaw in Amanda 3.5.1's runtar SUID binary. The exploit leverages flawed argument checking to execute arbitrary commands as root via the --checkpoint-action parameter.

Classification
Working Poc 100%
Attack Type
Lpe
Complexity
Trivial
Reliability
Reliable
Target: Amanda 3.5.1
Auth required
Prerequisites: Local access to a system with Amanda 3.5.1 installed · Backup user privileges
devstral-2 · analyzed Feb 18, 2026 Full analysis →

Scores

CVSS v3 6.7
EPSS 0.0125
EPSS Percentile 65.3%
Attack Vector LOCAL
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact total

Details

CWE
CWE-88
Status published
Products (1)
zmanda/amanda 3.5.1
Published Apr 16, 2023
Tracked Since Feb 18, 2026