CVE-2023-22809

HIGH EXPLOITED

Sudoedit Extra Arguments Priv Esc

Title source: metasploit
STIX 2.1

Exploitation Summary

CVE-2023-22809 has been observed exploited in the wild (reported by VulnCheck KEV). EIP tracks 18 public exploits from researchers including n3m1.sys, n3m1sys, P4x1s, including a Metasploit module exploits/linux/local/sudoedit_bypass_priv_esc.

AI-analyzed exploit summary This exploit leverages CVE-2023-22809 in sudo versions 1.8.0 to 1.9.12p1 to escalate privileges by abusing sudoedit/sudo -e to modify the sudoers file. It checks for vulnerable sudo versions and exploitable user permissions before attempting privilege escalation.

Description

In Sudo before 1.9.12p2, the sudoedit (aka -e) feature mishandles extra arguments passed in the user-provided environment variables (SUDO_EDITOR, VISUAL, and EDITOR), allowing a local attacker to append arbitrary entries to the list of files to process. This can lead to privilege escalation. Affected versions are 1.8.0 through 1.9.12.p1. The problem exists because a user-specified editor may contain a "--" argument that defeats a protection mechanism, e.g., an EDITOR='vim -- /path/to/extra/file' value.

Exploits (18)

exploitdb WORKING POC
by n3m1.sys · bashlocallinux
https://www.exploit-db.com/exploits/51217

This exploit leverages CVE-2023-22809 in sudo versions 1.8.0 to 1.9.12p1 to escalate privileges by abusing sudoedit/sudo -e to modify the sudoers file. It checks for vulnerable sudo versions and exploitable user permissions before attempting privilege escalation.

Classification
Working Poc 95%
Attack Type
Lpe
Complexity
Trivial
Reliability
Reliable
Target: sudo 1.8.0 to 1.9.12p1
Auth required
Prerequisites: User must have sudoedit/sudo -e privileges for a file as root or ALL · Vulnerable sudo version installed
devstral-2 · analyzed Feb 16, 2026 Full analysis →
nomisec WORKING POC 160 stars
by n3m1sys · poc
https://github.com/n3m1sys/CVE-2023-22809-sudoedit-privesc

This repository contains a functional exploit script for CVE-2023-22809, a sudo privilege escalation vulnerability. The script checks for vulnerable sudo versions and user privileges, then leverages sudoedit to modify the sudoers file for root access.

Classification
Working Poc 95%
Attack Type
Lpe
Complexity
Trivial
Reliability
Reliable
Target: sudo versions 1.8.0 to 1.9.12p1
Auth required
Prerequisites: User must have sudoedit or sudo -e privileges on a file as root · Vulnerable sudo version installed
devstral-2 · analyzed Feb 18, 2026 Full analysis →
nomisec WORKING POC 7 stars
by P4x1s · poc
https://github.com/P4x1s/CVE-2023-22809-sudo-POC

This exploit leverages CVE-2023-22809 in sudo versions 1.8.0 to 1.9.12p1, allowing local privilege escalation by abusing sudoedit/sudo -e to modify /etc/sudoers and gain root access. The script checks for vulnerable sudo versions and exploitable user permissions before guiding the attacker to add a malicious sudoers entry.

Classification
Working Poc 95%
Attack Type
Lpe
Complexity
Trivial
Reliability
Reliable
Target: sudo 1.8.0 to 1.9.12p1
Auth required
Prerequisites: Local user access · User must have sudoedit/sudo -e privileges for a file as root
devstral-2 · analyzed Feb 18, 2026 Full analysis →
nomisec WORKING POC 6 stars
by asepsaepdin · local
https://github.com/asepsaepdin/CVE-2023-22809

This repository contains a functional exploit for CVE-2023-22809, a local privilege escalation vulnerability in sudo versions 1.8.0 to 1.9.12p1. The exploit leverages the sudoedit feature to manipulate environment variables (SUDO_EDITOR, VISUAL, EDITOR) and append arbitrary files to gain root access.

Classification
Working Poc 95%
Attack Type
Lpe
Complexity
Trivial
Reliability
Reliable
Target: sudo 1.8.0 to 1.9.12p1
Auth required
Prerequisites: User must have sudoedit or sudo -e privileges · nano or vim editor installed
devstral-2 · analyzed Feb 18, 2026 Full analysis →
nomisec WORKING POC 6 stars
by M4fiaB0y · local
https://github.com/M4fiaB0y/CVE-2023-22809

The repository contains a functional exploit for CVE-2023-22809, a privilege escalation vulnerability in sudo versions 1.8.0 to 1.9.12p1. The exploit checks if the current user can run sudoedit or sudo -e as root, then opens the sudoers file to allow the attacker to add a line granting full privileges.

Classification
Working Poc 90%
Attack Type
Lpe
Complexity
Trivial
Reliability
Reliable
Target: sudo 1.8.0 to 1.9.12p1
Auth required
Prerequisites: User must have privileges to run sudoedit or sudo -e as root
devstral-2 · analyzed Feb 18, 2026 Full analysis →
nomisec WORKING POC 2 stars
by D0rDa4aN919 · local
https://github.com/D0rDa4aN919/CVE-2023-22809-Exploiter

This repository contains functional Python and Bash scripts designed to exploit CVE-2023-22809, a privilege escalation vulnerability in sudo versions 1.8.0 through 1.9.12p1. The exploit leverages improper handling of sudoedit or sudo -e commands to escalate privileges by manipulating environment variables like SUDO_EDITOR, VISUAL, and EDITOR.

Classification
Working Poc 90%
Attack Type
Lpe
Complexity
Moderate
Reliability
Reliable
Target: sudo versions 1.8.0 through 1.9.12p1
Auth required
Prerequisites: Access to sudo command with sudoedit or sudo -e capabilities · Vulnerable sudo version installed on the target machine
devstral-2 · analyzed Feb 18, 2026 Full analysis →
nomisec WORKING POC 2 stars
by Toothless5143 · local
https://github.com/Toothless5143/CVE-2023-22809

This repository contains a functional exploit for CVE-2023-22809, a vulnerability in sudo's sudoedit command that allows local privilege escalation to root. The script checks the sudo version, verifies exploitable sudo privileges, and guides the user to modify the sudoers file via vim to achieve root access.

Classification
Working Poc 90%
Attack Type
Lpe
Complexity
Trivial
Reliability
Reliable
Target: sudo versions 1.8.0 to 1.9.12p1
Auth required
Prerequisites: User must have sudoedit privileges configured in sudoers · Vulnerable sudo version installed
devstral-2 · analyzed Feb 18, 2026 Full analysis →
nomisec WORKING POC 2 stars
by Chan9Yan9 · local
https://github.com/Chan9Yan9/CVE-2023-22809

This repository contains functional exploit scripts for CVE-2023-22809, a sudoedit vulnerability allowing local privilege escalation by manipulating environment variables (SUDO_EDITOR, VISUAL, EDITOR) to bypass sudoers policy restrictions. The exploits modify /etc/passwd or /etc/sudoers to achieve root access.

Classification
Working Poc 95%
Attack Type
Lpe
Complexity
Moderate
Reliability
Reliable
Target: sudo 1.8.0 to 1.9.12p1
Auth required
Prerequisites: User must have sudoedit privileges · Vulnerable sudo version installed
devstral-2 · analyzed Feb 18, 2026 Full analysis →
nomisec WORKING POC 1 stars
by Spydomain · poc
https://github.com/Spydomain/CVE-2023-22809-automated-python-exploits

This repository contains a functional Python script that automates the exploitation of CVE-2023-22809, a local privilege escalation vulnerability in sudo's sudoedit feature. The script checks for vulnerable sudo versions and verifies sudoedit privileges before attempting to escalate to root by modifying /etc/sudoers.

Classification
Working Poc 90%
Attack Type
Lpe
Complexity
Trivial
Reliability
Reliable
Target: sudo (versions 1.8, 1.9.0 to 1.9.3, 1.9.12p1)
Auth required
Prerequisites: Vulnerable sudo version installed · User must have sudoedit privileges as root or (ALL) · Local access to the target system
devstral-2 · analyzed Feb 18, 2026 Full analysis →
github WORKING POC 1 stars
by Shockp · pythonpoc
https://github.com/Shockp/CVE-Exploits/tree/main/CVE-2023-22809 (sudoedit)

The repository contains functional exploit code for multiple CVEs, including CVE-2023-22809 (sudoedit), CVE-2019-0232 (Tomcat CGI), and CVE-2019-10945 (Joomla). The exploits demonstrate remote code execution (RCE) and directory traversal vulnerabilities with clear usage instructions.

Classification
Working Poc 95%
Attack Type
Rce, Auth Bypass, Info Leak
Complexity
Moderate
Reliability
Reliable
Target: sudoedit, Apache Tomcat, Joomla, Spring Cloud Function, Cacti
Auth required
Prerequisites: Target IP/URL · Valid credentials for authenticated exploits · Network connectivity to target
devstral-2 · analyzed Feb 27, 2026 Full analysis →
nomisec WORKING POC
by ValeuDoamne · local
https://github.com/ValeuDoamne/CVE-2023-22809

This repository contains a functional exploit for CVE-2023-22809, a vulnerability in sudoedit that allows privilege escalation. The script checks for sudoedit permissions and attempts to edit the /etc/sudoers file using vim, leveraging the vulnerability to gain elevated privileges.

Classification
Working Poc 90%
Attack Type
Lpe
Complexity
Trivial
Reliability
Reliable
Target: sudo (sudoedit)
Auth required
Prerequisites: User must have sudoedit permissions
devstral-2 · analyzed Feb 19, 2026 Full analysis →
nomisec SUSPICIOUS
by laxmiyamkolu · poc
https://github.com/laxmiyamkolu/SUDO-privilege-escalation

The repository claims to demonstrate CVE-2023-22809 (SUDO privilege escalation) but lacks actual exploit code, instead referencing external documents and scripts without providing technical details or code snippets.

Classification
Suspicious 90%
Attack Type
Lpe
Complexity
Theoretical
Reliability
Theoretical
Target: Sudo (unspecified version)
Auth required
Prerequisites: Access to a vulnerable Sudo configuration · Local user access
devstral-2 · analyzed Feb 18, 2026 Full analysis →
nomisec WORKING POC
by pashayogi · local
https://github.com/pashayogi/CVE-2023-22809

This repository contains a functional exploit for CVE-2023-22809, a privilege escalation vulnerability in sudo versions 1.8.0 to 1.9.12p1. The exploit checks for vulnerable sudo versions and user privileges, then leverages sudoedit to modify the sudoers file and gain root access.

Classification
Working Poc 95%
Attack Type
Lpe
Complexity
Trivial
Reliability
Reliable
Target: sudo 1.8.0 to 1.9.12p1
Auth required
Prerequisites: User must have sudoedit or sudo -e privileges · Vulnerable sudo version installed
devstral-2 · analyzed Feb 18, 2026 Full analysis →
nomisec STUB
by hello4r1end · poc
https://github.com/hello4r1end/patch_CVE-2023-22809

This repository contains a simple bash script to patch CVE-2023-22809 by installing an updated version of sudo. It does not include any exploit code or technical analysis of the vulnerability.

Classification
Stub 90%
Attack Type
Other
Complexity
Trivial
Reliability
Reliable
Target: sudo (versions prior to 1.9.13p3)
Auth required
Prerequisites: Linux-based system · wget installed · sudo privileges
devstral-2 · analyzed Feb 18, 2026 Full analysis →
vulncheck_xdb WRITEUP
local
https://github.com/AdrianM756/CyberSec_Documentation

This repository contains a detailed technical writeup on CVE-2023-22809, a privilege escalation vulnerability in sudoedit. It explains the root cause, exploitation method, and includes a step-by-step demonstration of how to escalate privileges by modifying /etc/passwd.

Classification
Writeup 95%
Attack Type
Lpe
Complexity
Moderate
Reliability
Reliable
Target: sudo 1.8.0 - 1.9.12p1
Auth required
Prerequisites: sudoedit access · user with sudoedit privileges
devstral-2 · analyzed Feb 25, 2026 Full analysis →
vulncheck_xdb WORKING POC
local
https://github.com/spidoman/CVE-2023-22809-automated-python-exploits

This repository contains a functional Python script that automates the exploitation of CVE-2023-22809, a local privilege escalation vulnerability in sudo's sudoedit feature. The script checks for vulnerable sudo versions and verifies sudoedit privileges before attempting to escalate to root by modifying /etc/sudoers.

Classification
Working Poc 90%
Attack Type
Lpe
Complexity
Trivial
Reliability
Reliable
Target: sudo (versions 1.8, 1.9.0 to 1.9.3, 1.9.12p1)
Auth required
Prerequisites: Vulnerable sudo version installed · User has sudoedit access with (root) or (ALL) privileges
devstral-2 · analyzed Feb 25, 2026 Full analysis →
metasploit WORKING POC EXCELLENT
by h00die, Matthieu Barjole, Victor Cutillas · rubypoc
https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/local/sudoedit_bypass_priv_esc.rb

This Metasploit module exploits CVE-2023-22809, a privilege escalation vulnerability in sudoedit (sudo -e) that allows appending arbitrary entries to files processed by sudo, enabling root privilege execution. It targets Ubuntu 22.04 and 22.10 with specific sudo versions.

Classification
Working Poc 100%
Attack Type
Lpe
Complexity
Moderate
Reliability
Reliable
Target: sudo 1.8.0 through 1.9.12.p1 (Ubuntu 22.04/22.10)
Auth required
Prerequisites: Local shell access · Sudoedit/sudo -e permissions on a file · Ubuntu 22.04 or 22.10
devstral-2 · analyzed Feb 16, 2026 Full analysis →

References (14)

Core 14
Core References
Exploit, Mitigation, Vendor Advisory
https://www.sudo.ws/security/advisories/sudoedit_any/
Exploit, Mitigation, Technical Description, Third Party Advisory
https://www.synacktiv.com/sites/default/files/2023-01/sudo-CVE-2023-22809.pdf
Mailing List, Third Party Advisory mailing-list
https://lists.debian.org/debian-lts-announce/2023/01/msg00012.html
Third Party Advisory vendor-advisory
https://www.debian.org/security/2023/dsa-5321
Exploit, Mailing List, Third Party Advisory mailing-list
http://www.openwall.com/lists/oss-security/2023/01/19/1
Third Party Advisory vendor-advisory
https://security.gentoo.org/glsa/202305-12
Mailing List, Third Party Advisory mailing-list
http://seclists.org/fulldisclosure/2023/Aug/21

Scores

CVSS v3 7.8
EPSS 0.4437
EPSS Percentile 97.7%
Attack Vector LOCAL
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact total

Details

VulnCheck KEV 2024-12-06
CWE
CWE-269
Status published
Products (7)
apple/macos < 13.4
debian/debian_linux 10.0
debian/debian_linux 11.0
fedoraproject/fedora 36
fedoraproject/fedora 37
sudo_project/sudo 1.9.12 (2 CPE variants)
sudo_project/sudo 1.8.0 - 1.9.12
Published Jan 18, 2023
Tracked Since Feb 18, 2026