CVE-2025-50505 Overview
CVE-2025-50505 is a local privilege escalation vulnerability in Clash Verge Rev through version 2.2.3. The application installs the clash-verge-service system service by default and exposes an unauthenticated HTTP API endpoint at /start_clash. Local users can submit arbitrary bin_path parameters to this endpoint, which the service passes directly to the process execution routine. This allows any local user to execute arbitrary binaries with the elevated privileges of the service account. The issue is fixed in version 2.3.0 and is categorized under [CWE-250: Execution with Unnecessary Privileges].
Critical Impact
Any local user can escalate to root or SYSTEM privileges by sending a single HTTP request to the local service, with no authentication required.
Affected Products
- Clash Verge Rev versions up to and including 2.2.3
- clash-verge-service component installed by default with Clash Verge Rev
- Fixed in Clash Verge Rev 2.3.0
Discovery Timeline
- 2025-10-07 - CVE CVE-2025-50505 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-50505
Vulnerability Analysis
Clash Verge Rev is a cross-platform proxy client built on the Clash Meta core. To manage system-level networking features such as TUN mode, the installer deploys a helper daemon called clash-verge-service that runs with elevated privileges. This helper exposes a local HTTP API to accept control commands from the desktop application.
The /start_clash endpoint on this local API accepts a bin_path parameter that specifies which binary to launch as the Clash core process. The service does not authenticate callers and does not validate or restrict the supplied path. Any local process, regardless of its user context, can reach the listening port and instruct the privileged service to spawn an arbitrary executable.
Because the spawned process inherits the service's privileges, an unprivileged attacker who can send loopback HTTP traffic gains full code execution as the service account. The default installation behavior removes user consent from the attack chain.
Root Cause
The root cause is a classic execution-with-unnecessary-privileges flaw [CWE-250]. The service accepts an untrusted bin_path input from a non-authenticated local channel and forwards it to a process-creation call without applying an allowlist, signature check, or caller authorization. The design assumes any local caller is trusted, which does not hold on multi-user systems.
Attack Vector
Exploitation requires only local access to the machine. A low-privileged user issues an HTTP POST to the loopback interface targeting the /start_clash route exposed by clash-verge-service, supplying a bin_path value that points to an attacker-controlled binary or a system tool such as cmd.exe or /bin/sh. The privileged service invokes that path directly. The proof-of-concept published in the GitHub PoC Repository demonstrates this request pattern. No user interaction on the desktop client is required, and the exploit does not need to defeat any authentication.
Detection Methods for CVE-2025-50505
Indicators of Compromise
- Child processes spawned by clash-verge-service that are not the expected Clash Meta core binary
- Unexpected shells, script interpreters, or LOLBin executions parented to the Clash Verge service
- HTTP requests to the local service port containing the /start_clash path from non-Clash-Verge client processes
- New privileged files, scheduled tasks, or accounts created shortly after clash-verge-service process activity
Detection Strategies
- Baseline the legitimate bin_path values used by the Clash Verge desktop client and alert on deviations
- Monitor process-creation telemetry for clash-verge-service acting as parent to non-allowlisted binaries
- Inspect local HTTP traffic on the service listener for /start_clash requests originating from non-Clash-Verge processes
- Correlate installation of Clash Verge Rev versions at or below 2.2.3 with the presence of the vulnerable service
Monitoring Recommendations
- Enable command-line and parent-process logging on endpoints where Clash Verge Rev is installed
- Forward endpoint process telemetry to a central data lake for behavioral analytics against the service's parent-child chain
- Track service binary hashes and configuration changes for clash-verge-service across the fleet
How to Mitigate CVE-2025-50505
Immediate Actions Required
- Upgrade Clash Verge Rev to version 2.3.0 or later on all affected endpoints
- Uninstall or stop the clash-verge-service component where the desktop application is not required
- Audit endpoints for unauthorized installations of Clash Verge Rev, which is commonly user-installed outside IT provisioning
- Restrict low-privileged users from installing software that deploys privileged helper services
Patch Information
The maintainers fixed the issue in Clash Verge Rev 2.3.0. Refer to the Clash Verge Rev GitHub Project Repository and the clash-verge-service Repository for release notes and updated binaries. Additional context is available in the vulnrichment issue discussion and on the Clash Verge Official Site.
Workarounds
- Block or firewall the local HTTP port used by clash-verge-service from non-application callers if upgrade is not immediately possible
- Disable the clash-verge-service system service and rely on non-privileged features of the client only
- Remove the service binary from systems where TUN mode and other privileged features are not needed
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
