T05 · Unauthorized Access and Privilege Escalation
Error
- Location
- references/users.md:68
- Finding
- Unrestricted Passwordless Root Access Through Sudoers Configuration## Vulnerability Details **File Location**: `references/users.md`, line 68 **Vulnerability Type**: Unrestricted passwordless privilege escalation **Risk Level**: High **Vulnerable Code**: ```text username ALL=(ALL) NOPASSWD: ALL ``` ### Technical Analysis The documented sudoers rule grants `username` permission to execute every command as any user, including root, without authentication. This violates least-privilege principles and removes the password prompt that would otherwise provide an additional control against unauthorized privilege escalation. Although the Skill is a command-reference document and does not apply this configuration automatically, an agent or administrator following the guidance could introduce a persistent access-control weakness. The reference provides no command restrictions, authentication requirement, `visudo` validation guidance, explicit authorization requirement, or rollback procedure. ### Attack Path 1. An agent or administrator adds the documented rule to the system's sudoers configuration. 2. An attacker compromises the `username` account, obtains execution in its session, or exploits an application running under that account. 3. The attacker invokes an arbitrary command through `sudo`, such as starting a root shell. 4. Because the rule uses `NOPASSWD: ALL`, no password or additional authentication is required. 5. The attacker gains unrestricted root-level control of the host. ### Impact Assessment Successful exploitation grants complete administrative privileges on the affected system. An attacker could read or modify protected data, access credentials, alter security controls, create accounts, install persistent services or scheduled tasks, tamper with logs, and execute arbitrary commands as root. The impact applies to any host where this example is implemented. The package itself contains no script that automatically installs the rule.
- Remediation
- ## Remediation Suggestions - Remove the unrestricted `NOPASSWD: ALL` example. - Grant only the minimum commands required for a defined operational role, using absolute executable paths and narrowly scoped arguments where feasible. - Retain password authentication unless a documented automation requirement makes passwordless execution unavoidable. - Place approved rules in a dedicated file under `/etc/sudoers.d/` with restrictive ownership and permissions. - Edit and validate sudoers rules using `visudo` or `visudo -cf` before deployment. - Require explicit user authorization before modifying sudo privileges. - Avoid granting access to interpreters, shells, editors, or commands that can escape into arbitrary command execution. - Document testing, auditing, expiration, and rollback procedures for every elevated permission.