CVE-2021-31154
📋 TL;DR
CVE-2021-31154 is a local privilege escalation vulnerability in the 'please' command-line tool versions before 0.4. It uses predictable temporary filenames, allowing local attackers to stage symlink attacks and gain full root privileges. This affects systems where 'please' is installed and accessible to local users.
💻 Affected Systems
- please (command-line tool)
📦 What is this software?
Pleaseedit by Pleaseedit Project
⚠️ Risk & Real-World Impact
Worst Case
Local attacker gains full root privileges on the system, enabling complete system compromise, data theft, persistence, and lateral movement.
Likely Case
Local user with limited privileges escalates to root, gaining unauthorized access to sensitive files, configuration, and system resources.
If Mitigated
Attack fails due to proper file permissions, SELinux/AppArmor restrictions, or lack of local user access to 'please' binary.
🎯 Exploit Status
Exploit requires local user access and knowledge of predictable temporary filename patterns. Symlink attack technique is well-documented.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 0.4 and later
Vendor Advisory: https://gitlab.com/edneville/please/-/tree/master/src/bin
Restart Required: No
Instructions:
1. Check current version: 'please --version' 2. Update to version 0.4 or later: 'pip install --upgrade please' or use system package manager 3. Verify update: 'please --version' should show 0.4+
🔧 Temporary Workarounds
Remove or restrict 'please' binary
linuxRemove the 'please' tool or restrict its execution to trusted users only
sudo rm /usr/local/bin/please
sudo chmod 700 /usr/local/bin/please
Use secure temporary directory
linuxSet TMPDIR environment variable to a secure, user-specific directory
export TMPDIR=/tmp/$USER-secure
mkdir -p $TMPDIR
🧯 If You Can't Patch
- Remove execute permissions for non-privileged users: 'sudo chmod 750 /usr/local/bin/please'
- Implement strict file system monitoring for symlink creation in /tmp and target directories
🔍 How to Verify
Check if Vulnerable:
Check 'please' version: 'please --version' - if version is less than 0.4, system is vulnerableCheck Version:
please --versionVerify Fix Applied:
After update, run 'please --version' to confirm version 0.4 or higher is installed📡 Detection & Monitoring
Log Indicators:
- Unusual symlink creation in /tmp directory
- Multiple failed 'please' command executions from same user
- Sudden privilege escalation events
Network Indicators:
- Not applicable - local attack only
SIEM Query:
source="audit.log" AND (event_type="SYMLINK" AND path="/tmp/*") OR (process="please" AND user_change="root")