access.redhat.comvdb entry
https://access.redhat.com/security/cve/CVE-2025-12744 CVE-2025-12744
HIGH
Abrt: command-injection in abrt leading to local privilege escalation
Record summary
CVE-2025-12744 has a selected CVSS score of 8.8 (high); EIP currently links 1 catalogued exploit and 1 repository PoC.
Description
A flaw was found in the ABRT daemon’s handling of user-supplied mount information.ABRT copies up to 12 characters from an untrusted input and places them directly into a shell command (docker inspect %s) without proper validation. An unprivileged local user can craft a payload that injects shell metacharacters, causing the root-running ABRT process to execute attacker-controlled commands and ultimately gain full root privileges.
Description source: CVE List
Exploitation context
Affected products and versions
4| Product | Source | Version range | Status |
|---|---|---|---|
Default status: unknown | CVE List | Version data not supplied | |
Default status: unaffected | CVE List | Version data not supplied | |
Default status: affected | CVE List | Version data not supplied | |
abrtDefault status: unaffected | CVE List | Before 2.17.7 | affected |
Proofs of concept
2Catalogued exploits
ExploitDBFedora - Local Privilege EscalationExploitDB exploitby ChrisExploit1 file
Analysis
Technical assessment
Python script that exploits CVE-2025-12744, a command injection in Fedora's ABRT daemon, to escalate privileges to root by injecting shell metacharacters via mountinfo and writing a sudoers entry.
Backdoor review
No backdoor observed in reviewed code
The PoC is a local privilege escalation exploit for CVE-2025-12744 in Fedora's ABRT. It crafts payloads to inject shell commands via the ABRT socket, writes a helper script to the current directory, and uses the vulnerability to append the current user to /etc/sudoers. All actions are consistent with the stated exploit goal and no concealed, deceptive, or unrelated harmful behavior is observed.
ClassificationExploit
Model confidence98%
AuthenticationRequired
Languages
Target software
Attack types
Evidence & reasoningClassification basis · observed behavior · safety review
Classification basis and observed behavior
Classification basis
The script actively exploits CVE-2025-12744 by injecting shell commands via the mountinfo field to write and execute a payload that modifies /etc/sudoers, granting root privileges. It is not merely detecting or reporting the vulnerability.
exploits/linux/local/52515.py:1-8exploits/linux/local/52515.py:39-74exploits/linux/local/52515.py:96-145Requirements
- Local unprivileged user access on a vulnerable Fedora system running ABRT <= 2.17.7
exploits/linux/local/52515.py:1-8 - ABRT daemon socket accessible at /var/run/abrt/abrt.socket
exploits/linux/local/52515.py:28
Observed behavior
- Sends crafted HTTP POST requests to the ABRT Unix socket with a mountinfo field containing a 12-character shell injection payload
exploits/linux/local/52515.py:39-74 - Writes a helper script to the current directory that uses systemd-run to append the current user to /etc/sudoers with NOPASSWD: ALL
exploits/linux/local/52515.py:99-109 - Uses a reset token to clear a file, then iteratively appends characters to build a second-stage script on the target, and finally executes it to chain to the sudoers-modifying script
exploits/linux/local/52515.py:31-33exploits/linux/local/52515.py:120-139
Behaviors behind the backdoor verdict
Observables
- File Write
- Payload withheldThis is the final payload of the exploit, achieving privilege escalation as described.
exploits/linux/local/52515.py:105-108 - Socket Communication
- Payload withheldThis is the attack vector for the CVE-2025-12744 command injection vulnerability.
exploits/linux/local/52515.py:62-74 - Command Injection
- Payload withheldThis is the core exploitation technique for the described CVE.
exploits/linux/local/52515.py:32exploits/linux/local/52515.py:89-93
What the analysis did not establish
- Only the exploit script content was analyzed; no external dependencies, libraries, or target environment were inspected.
- The script's effectiveness, reliability, or safety was not tested or verified.
- Only the single Python script was reviewed; no external dependencies or referenced resources were inspected.
- The review does not assess whether the exploit is functional or safe to execute.
Model interpretation
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.
Repository PoCs
GitHubinitstring/abrt_rootRepository PoCby initstringStars: 7Exploit3 files
Analysis
Technical assessment
A Python script that exploits CVE-2025-12744, a command injection in the ABRT daemon, to add the current low-privilege user to /etc/sudoers, granting root access.
Backdoor review
No backdoor observed in reviewed code
The supplied evidence consists of a README and a Python exploit script (abrt_root.py) for CVE-2025-12744. The script performs the documented local privilege escalation by injecting commands into the ABRT daemon to add the current user to /etc/sudoers. No concealed, deceptive, or unrelated harmful behavior was observed. The script's actions are consistent with the stated exploit goal.
ClassificationExploit
Model confidence100%
AuthenticationRequired
Languages
Target software
Attack types
Evidence & reasoningClassification basis · observed behavior · safety review
Classification basis and observed behavior
Classification basis
The artifact is a complete Python script that actively exploits a command injection vulnerability to escalate privileges by modifying /etc/sudoers. It sends malicious payloads to the ABRT daemon and executes a multi-stage attack chain.
README.md:3abrt_root.py:1-138Requirements
- Local unprivileged user access on a vulnerable Fedora system with ABRT daemon running.
README.md:3-5 - Write access to a directory without special characters (e.g., home directory) to stage a helper script.
README.md:17
Observed behavior
- Writes a helper script (final) to the current working directory that uses systemd-run to append a sudoers entry for the current user.
abrt_root.py:96-102 - Sends crafted HTTP POST requests over a Unix socket to the ABRT daemon, injecting shell metacharacters into the mountinfo field.
abrt_root.py:44abrt_root.py:55-67 - Uses a multi-stage injection: first clears a file, then writes a second-stage script character by character, and finally executes it to chain to the third-stage helper script.
abrt_root.py:113-132
Behaviors behind the backdoor verdict
Observables
- Exploit Behavior
- Payload withheldThis is the final payload of the exploit, matching the documented purpose of gaining root privileges.
abrt_root.py:98-101 - Exploit Behavior
- Payload withheldThis is the core exploitation technique described in the CVE and README.
abrt_root.py:55-67 - Exploit Behavior
- Payload withheldThis is part of the multi-stage exploit chain described in the script comments.
abrt_root.py:122-126
What the analysis did not establish
- One file (total 3) was omitted from the packet; its content is not available for analysis.
- The evidence does not include the ABRT daemon source code or the vulnerable function, only the exploit script and README.
- One file (metadata only, flagged as non-text) was not inspected; its content is unknown but classified as non-text media.
Model interpretation
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.
References
3RHBZ#2412467issue tracking
https://bugzilla.redhat.com/show_bug.cgi?id=2412467 nvd.nist.gov
https://nvd.nist.gov/vuln/detail/CVE-2025-12744