Vulnerability Discussion

If the "sudoers" file is not configured correctly, any user defined on the system can initiate privileged actions on the target system.

Check

Verify the operating system restricts privilege elevation to authorized personnel with the following command:

$ sudo grep -iwR 'ALL' /etc/sudoers /etc/sudoers.d/ | grep -v '#'

If either of the following entries are returned, this is a finding:

ALL ALL=(ALL) ALL
ALL ALL=(ALL:ALL) ALL

Fix

Configure the operating system to restrict privilege elevation to authorized personnel.

Remove the following entries from the /etc/sudoers file or any configuration file under /etc/sudoers.d/:

ALL ALL=(ALL) ALL
ALL ALL=(ALL:ALL) ALL