CVE-2024-32019:

Netdata ndsudo

CVE-2024-32019 in Netdata’s ndsudo is a local privilege escalation where a user can abuse the fact that ndsudo runs with root privileges (SUID) but can end up resolving and executing helper programs via an attacker-influenced search path (like PATH). In practice, an attacker places a malicious binary with the same name as a helper ndsudo expects to call and ensures it’s found first, so when ndsudo launches it, that payload runs as root. The result is arbitrary command execution as root, meaning a local user can fully compromise the host.

Below are general examples of techniques, methods, and proof-of-concept approaches used to demonstrate this vulnerability in a controlled environment.