Local Privilege Escalation in Facebook Below (CVE-2025-27591)

CVE-2025-27591 is a local privilege escalation vulnerability affecting the Facebook 'below' system monitoring tool, specifically versions prior to 0.9.0. The vulnerability originates from the insecure management of log files when the application is executed with elevated privileges, specifically using the 'below record' command. An attacker with local access to the system can leverage a symlink attack to redirect the application's error logging to critical system files, such as /etc/passwd. By exploiting this behavior, an attacker can append a malicious user entry to the password file, effectively granting them unauthorized root-level access. The proof-of-concept exploit is publicly available, increasing the risk for environments where 'below' is installed and used with sudo permissions.

Attack Chain

1. The attacker ensures the application's target log file, typically located at /var/log/below/error_root.log, does not already exist.
2. The attacker creates a symbolic link at /var/log/below/error_root.log that points to the system's /etc/passwd file.
3. The attacker executes the 'below' binary with elevated privileges using the 'sudo /usr/bin/below record' command.
4. The application, running as root, attempts to write error logs to the path redirected by the attacker.
5. The attacker provides crafted input designed to trigger an error, causing the application to write data into the target /etc/passwd file.
6. The attacker verifies that a new, unauthorized user has been successfully appended to the /etc/passwd configuration.
7. The attacker uses the newly created credentials to authenticate and obtain a root shell on the system.

Impact

Successful exploitation of CVE-2025-27591 results in full system compromise. An unprivileged attacker can escalate to root privileges, gaining complete control over the affected host. This vulnerability impacts systems where 'below' is installed and invoked via sudo, common in development, testing, or infrastructure monitoring environments.

Recommendation

Prioritize the immediate upgrade of the Facebook 'below' monitoring tool to version 0.9.0 or later to remediate the insecure log file handling. If patching cannot be performed immediately, monitor for unauthorized symbolic link creation within the /var/log/below/ directory.

Tags

• privilege-escalation
• linux