Misconfigured sudoers Rule Grants Unprivileged User Full Root Access

·1 views

A cybersecurity researcher demonstrated how a single misconfigured line in the Linux sudoers file can silently escalate an unprivileged user to root. The vulnerable setup involved granting a user permission to run a specific program as root without a password using the NOPASSWD directive. While the configuration appeared limited in scope, the program's capabilities when running as root far exceeded its intended purpose. The researcher documented the full exploitation cycle, from discovery to privilege escalation, and then showed how correcting the sudoers entry closed the vulnerability. The lab highlights a common DevSecOps blind spot: apparent permission boundaries do not always reflect actual system capabilities.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Two-Artifact Freeze Method Keeps AI Patch Reviews Scoped to Real Bugs

Open-source maintainers risk unintended API expansions when coding models generate overreaching diffs in response to bug reports. A proposed workflow requires freezing two artifacts before any model session begins: a git bisect SHA identifying the first bad commit, and a snapshot of existing public API names. These two files act as hard merge gates, restricting model edits strictly to files changed in the offending commit. The bisect must confirm a reproducible test failure before any chat session starts, and a flaky test halts the entire process. The method aims to prevent silent surface-area growth and keep code review focused on the actual defect rather than model-suggested additions.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

AI Agents Excel at Exploratory Testing but Fall Short for Regression Suites

AI agents have proven effective for exploratory testing by dynamically navigating interfaces, reacting to unexpected states, and investigating bugs without fully predefined steps. However, regression testing demands repeatable, documented action sequences and consistent checks so that results across multiple runs can be meaningfully compared. When an agent adaptively chooses alternate paths or accepts different signals as proof of success, it undermines the comparability that regression testing requires. Experts argue teams should use AI agents for ambiguous, one-off, or investigative tasks while investing in structured test assets for workflows that must be verified before every release. The key question for testing teams is not whether to use agents or automation, but which work benefits from flexibility and which requires repeatability.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

How Postgres Advisory Locks Prevent Double-Counted Bids in Pay-to-Rank Apps

A developer behind Steal the Spot, a pay-to-rank leaderboard where every bid is real money, shared a concurrency-safe payment pattern built on Supabase Postgres and Dodo webhooks. The core problem addressed is duplicate webhook deliveries and simultaneous bids causing incorrect rankings or double-applied payments. The solution uses pg_advisory_xact_lock to serialize bids per season, an idempotency check that detects already-processed payment IDs, and a FOR UPDATE row lock to prevent interleaved rank calculations. The advisory lock's transaction-scoped variant ensures a crashed worker cannot permanently block the system. Access to the underlying database function is restricted to the service role, preventing clients from manipulating their own rank directly.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Developer Learns Hard Lessons Adding Chinese to an AI-Powered Codenames Game

A developer who built an AI-powered Codenames web game added Simplified Chinese word sets after a reader requested multi-language support. AI tools generated candidate translations quickly, but evaluating whether they were natural or appropriately ambiguous still required human judgment. An automated validator that flagged substring overlaps as hard errors initially pushed translations toward unnatural single-character fragments and awkward abbreviations. Relaxing the rule so overlaps triggered review rather than build failures allowed more natural Chinese words to be used. The key insight was that automated validators can catch structural errors like duplicates, but product decisions about word meaning and naturalness require human oversight.

0 comments Read more at DEV Community