CVE-2025-27591 PoC — below 安全漏洞

Source

https://github.com/obamalaolu/CVE-2025-27591

Associated Vulnerability

Title: below 安全漏洞 (CVE-2025-27591)
Description:A privilege escalation vulnerability existed in the Below service prior to v0.9.0 due to the creation of a world-writable directory at /var/log/below. This could have allowed local unprivileged users to escalate to root privileges through symlink attacks that manipulate files such as /etc/shadow.

Description

CVE-2025-27591

Readme

# CVE-2025-27591 - Privilege Escalation via `below`

This repository contains an exploit for **CVE-2025-27591**, a privilege escalation vulnerability in the Linux monitoring tool **Below**.

## 🛠️ Vulnerability Details

- **CVE**: CVE-2025-27591  
- **CVSS Score**: 7.8 (High)  
- **Affected Tool**: [`below`](https://github.com/facebookincubator/below) (prior to `v0.9.0`)  
- **Vulnerability**: Below creates world-writable directories and log files (`/var/log/below/error_root.log`) as root, allowing symlink attacks by unprivileged users.
- **Discovered**: January 2025  
- **Published**: March 12, 2025  
- **Source**: [SecurityOnline](https://securityonline.org/), [OpenWall](https://www.openwall.com/)

## 💥 Exploit Summary

This exploit allows a local user to escalate privileges to root by:

1. Symlinking `/var/log/below/error_root.log` to `/etc/passwd`
2. Triggering `below` to write to the symlink
3. Injecting a malicious root user into `/etc/passwd`

## ⚙️ Requirements

- `below` is available via `sudo`, e.g.:

```bash
sudo -l
(ALL : ALL) NOPASSWD: /usr/bin/below *

File Snapshot

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →