CVE-2025-27591 - Privilege Escalation via below

This repository contains an exploit for CVE-2025-27591, a privilege escalation vulnerability in the Linux monitoring tool Below.

🛠️ Vulnerability Details

• CVE: CVE-2025-27591
• CVSS Score: 7.8 (High)
• Affected Tool: below (prior to v0.9.0)
• Vulnerability: Below creates world-writable directories and log files (/var/log/below/error_root.log) as root, allowing symlink attacks by unprivileged users.
• Discovered: January 2025
• Published: March 12, 2025
• Source: SecurityOnline, OpenWall

💥 Exploit Summary

This exploit allows a local user to escalate privileges to root by:

1. Symlinking /var/log/below/error_root.log to /etc/passwd
2. Triggering below to write to the symlink
3. Injecting a malicious root user into /etc/passwd

⚙️ Requirements

• below is available via sudo, e.g.:

sudo -l
(ALL : ALL) NOPASSWD: /usr/bin/below *