CVE-2023-42456: Path Traversal vulnerability in sudo-rs
Summary
CVE-2023-42456: sudo-rs: Path Traversal vulnerability. Affects sudo-rs versions >= 0.0.0-0, < 0.2.1. Fixed in 0.2.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
sudo-rs is a crate for Rust programming language that provides a safe and efficient way to execute commands with elevated privileges. It is commonly used in Rust projects to handle administrative tasks. However, a vulnerability has been discovered in sudo-rs that allows for path traversal attacks, potentially leading to the corruption of critical files on the filesystem.
Vulnerability Detail
The vulnerability in sudo-rs arises from the way it handles usernames. By constructing a username containing the characters '.' and '/', an attacker can create a relative path that is resolved incorrectly by the session code. This can result in the corruption or removal of specific files on the system. An attacker would need the ability to log in as a user with a constructed username and the ability to create users with such usernames. The impact of this vulnerability can be severe, as it allows an attacker to manipulate critical files and potentially disrupt the functioning of the system.
How To Fix
Latest published version: 0.2.15 as of 23 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
0.2.1
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. The recommended solution is to upgrade to version 0.2.1 of sudo-rs.
Conclusion
The path traversal vulnerability in sudo-rs can be exploited by constructing a username with specific characters, allowing an attacker to corrupt or remove critical files on the system. To mitigate this vulnerability, it is crucial to upgrade to version 0.2.1 of sudo-rs. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for sudo-rs →
FAQ
sudo-rs is a crate for Rust programming language that provides a safe and efficient way to execute commands with elevated privileges.
Path traversal vulnerability is a type of security vulnerability where an attacker can manipulate file paths to access files or directories outside of the intended scope.
An attacker can exploit this vulnerability by creating a user with a constructed username containing the characters '.' and '/'. When logged in as that user, they can run sudo -K to clear their session record file, which results in the corruption or removal of specific files on the system.
The impact of this vulnerability can be severe, as it allows an attacker to manipulate critical files and potentially disrupt the functioning of the system.
To fix this vulnerability, it is recommended to upgrade to version 0.2.1 of sudo-rs, which uses the user's UID instead of their username to determine the filename. This eliminates the possibility of path traversal. Existing session files will be ignored after the upgrade, and users will need to re-authenticate.
Related vulnerabilities
Recent vulnerabilities recorded for sudo-rs.
