CVE-2025-27591 PoC — below 安全漏洞

Description

CVE-2025-27591

介绍

# CVE-2025-27591 - Privilege Escalation via `below`

This repository contains an exploit for **CVE-2025-27591**, a privilege escalation vulnerability in the Linux monitoring tool **Below**.

## 🛠️ Vulnerability Details

- **CVE**: CVE-2025-27591  
- **CVSS Score**: 7.8 (High)  
- **Affected Tool**: [`below`](https://github.com/facebookincubator/below) (prior to `v0.9.0`)  
- **Vulnerability**: Below creates world-writable directories and log files (`/var/log/below/error_root.log`) as root, allowing symlink attacks by unprivileged users.
- **Discovered**: January 2025  
- **Published**: March 12, 2025  
- **Source**: [SecurityOnline](https://securityonline.org/), [OpenWall](https://www.openwall.com/)

## 💥 Exploit Summary

This exploit allows a local user to escalate privileges to root by:

1. Symlinking `/var/log/below/error_root.log` to `/etc/passwd`
2. Triggering `below` to write to the symlink
3. Injecting a malicious root user into `/etc/passwd`

## ⚙️ Requirements

- `below` is available via `sudo`, e.g.:

```bash
sudo -l
(ALL : ALL) NOPASSWD: /usr/bin/below *

文件快照

备注