Listen to this Post
How the Mentioned CVE Works
The vulnerability (CVE-2025-35916) in the `sd` command-line search-and-replace tool stems from its file operation logic. When `sd` processes a file, it creates a temporary output file with the results before replacing the original. The flaw occurs during this replacement step. On Unix-like systems, the tool uses a `rename` operation which preserves the original file’s ownership and permissions. However, prior to v1.0.1, `sd` incorrectly modifies the group ownership of the final file under specific conditions related to the user’s group membership. If an attacker can influence the execution of `sd` on a file owned by a privileged group (e.g., root), the command may change the group ownership to the attacker’s group. This corrupts the file’s security attributes. By subsequently manipulating this mis-owned file, which may be a script or binary executed with higher privileges, an attacker can achieve local privilege escalation to root. The exploit requires the attacker to have local shell access and the ability to run `sd` on a target file, leveraging the tool’s inherent trust in preserving metadata.
Platform: sd command
Version: <=1.0.0
Vulnerability: Privilege escalation
Severity: Moderate
date: 2025-12-10
Prediction: 2025-12-17
What Undercode Say:
Example of a normal, non-malicious sd command usage: sd 'foo' 'bar' important_script.sh The vulnerability triggers during the file write operation. A proof-of-concept might involve targeting a setgid script: find / -group root -perm -2000 -type f 2>/dev/null | head -5 An attacker could craft a malicious pipeline to exploit the race condition or ownership change flaw after identifying a suitable target.
How Exploit:
- Attacker gains local shell access on the target system.
- Identifies a critical file (e.g., a cron script or setgid binary) owned by root or a privileged group.
- Executes the `sd` command on that file, possibly via a compromised user script or allowed context.
- The flawed `sd` process changes the file’s group ownership to the attacker’s group.
- Attacker modifies the now group-writable file with malicious code.
- When the legitimate system process (running as root) executes the tampered file, privilege escalation is achieved.
Protection from this CVE
1. Upgrade `sd` to version 1.0.1 or later.
- Restrict execution of `sd` via user/group permissions or sudoers.
- Audit system for unusual group ownership on sensitive files.
- Use package managers to verify installed tool integrity.
Impact:
Local privilege escalation from a low-privilege user account to root, leading to full system compromise, data theft, and persistent backdoor installation.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
