Velociraptor vulnerabilities

Velociraptor stores the compiled VQL in the hunt object internally to avoid having to recompile the artifacts for each endpoint in the hunt. Although the field "compiled_collector_args" is an internal field, Velociraptor allowed the field to be set from a user API call. This allows another user who can schedule a hunt (minimal role of "investigator") to set the compiled VQL statements for the hunt bypassing any ACL checks that would normally be applied. This flaw can then be escalated to allow the "investigator" user to run arbitrary VQL statements as an administrator user on the Velociraptor server.

Velociraptor allows some sensitive artifacts to be gated by additional permissions, e.g. Linux.Sys.BashShell requires EXECVE. However, no such check was implemented for client monitoring artifacts, and there was no requirement that they carry the CLIENT_EVENTS type. This allows any user who can schedule client monitoring artifacts to also schedule otherwise restricted artifacts.

Velociraptor allows collection of VQL queries packaged into Artifacts from endpoints. The Windows.Sysinternals.SysmonLogForward artifact allows the user to specify an arbitrary binary path as a parameter and did not enforce an additional required permission, allowing users with COLLECT_CLIENT permissions to run a different binary program than the installed sysmon binary.

Velociraptor's SetClientMetadata used the wrong permission check to enforce setting metadata on the server. This allows a user with LABEL_CLIENTS permission to update the server metadata, which is often used to store site-wide configuration data that should only be updated by the server admin.

Velociraptor's WatchEvent gRPC API can specify the OrgId of the org from which events should be streamed. The server checks API permissions against the caller's Org instead of the requested Org. This allows a user with API access in one org to read events from another org for which they have no access.

Velociraptor contains a deadlock condition that may be triggered by authenticated users. The issue stems from a lock management bug in the user management module.

Velociraptor's prefetch library contains an out of bound vulnerability which may cause a crash when parsing certain malformed prefetch files.

Velociraptor creates notebook backups in its default enabled daily backup feature. When Velociraptor restores the backup, the notebook cell content is interpolated into a template with no ACL checks. This allows a malicious user with NOTEBOOK_EDITOR permission to plant a VQL query that will be evaluated at elevated permissions if the notebook's backup is subsequently restored.

The Velociraptor verify() VQL function allows a user to verify an artifact for syntactic and other issues. Due to an implementation fault, the global artifact repository is used, allowing callers to overwrite existing artifacts without the required permissions. The attacker only needs NOTEBOOK_EDIT permission (e.g., an analyst role) to call this function.

Velociraptor's web GUI allows specifying a custom type for columns in tables. The URL type takes the cell value and forms a URL which can be clicked in the GUI. The code does not limit the schemes allowed in this URL, allowing an attacker to specify a JavaScript scheme exposing the user to XSS.

Velociraptor fails to sanitize data when exporting to CSV, which can lead to formula execution by Microsoft Excel during import. Cells starting with certain characters are treated as formulas, allowing arbitrary code execution.

The hunt_delete() VQL function in Velociraptor allows deleting hunts. Velociraptor misapplied the permission check, requiring only COLLECT_CLIENT (usually assigned to the 'investigator' role) instead of the DELETE_RESULTS permission (usually only assigned to administrators).

A rogue Velociraptor client can upload a malformed sparse file that causes a panic when the GUI attempts to expand it, potentially crashing the server process. The issue is a Divide by Zero bug in the ShouldPadFile() function.

Velociraptor allows reading Stacked result sets from the GUI due to incorrect path validation against the prefix deny list. A user with read access to the root org can access result sets from child orgs.

Velociraptor allows scheduling new collections via VQL queries in notebooks. The COLLECT_CLIENT permission is required, but it is not enforced when the user can run a VQL query that resets the authorization provider. A user with the analyst role can launch new collections, which usually require the investigator role, leading to privilege escalation.

The NewNotebook API does not sufficiently sanitize its parameters, allowing an authenticated user with NOTEBOOK_EDIT permission to write the notebook record outside the org's data store directory. The file written must have an extension of ".json.db" but can overwrite other metadata files, causing data corruption.

When Velociraptor is configured to use an OIDC IdP for authentication, it uses the email claim as a username. However, some IdPs allow users to change the email claim without verification, and some do not set the "email_verified" claim. This allows a user to impersonate another user by setting their email address within the IdP, enabling account takeover.

Any authenticated Velociraptor user, including one holding only the reader role, can terminate the entire server process with a single request by calling SetPassword with a username that does not exist.

Velociraptor allows an administrator of a child org to delete other orgs because it checks the ORG_ADMIN permission in the calling org instead of the ROOT org.

The Velociraptor gRPC API has a VFSGetBuffer endpoint that allows reading files from the datastore. To prevent users from reading sensitive files or accessing other orgs, the requested path is prefix checked against a list of denied prefixes. This prefix check can be bypassed allowing a user to access usually denied files. If the user has read permission in the ROOT org, this allows access to other orgs, in which the user may not have permission.

Velociraptor before 0.77.2 evaluates the IMPERSONATE permission against the caller's org instead of the target org, allowing an administrator in one org to impersonate a user in another org.

Velociraptor's NTFS parsing library mishandles several out of bound and memory exhaustion bugs which may be triggered by maliciously crafted NTFS images. Typically Velociraptor's NTFS parser is used on live NTFS filesystems, limiting the opportunity of attackers corrupting the filesystem. However, in some applications (e.g. dead disk forensics) Velociraptor may be used on untrusted NTFS image files. If an attacker is able to inject maliciously corrupted NTFS Volumes they can cause a crash and a Denial of Service.

Missing authorization check in the upload_azure, upload_sftp, and upload_smb VQL plugins allows an authenticated analyst-role user to initiate attacker-controlled outbound network connections from the Velociraptor server, bypassing the NETWORK ACL permission boundary. This enables internal network reconnaissance and potential data exfiltration.

In Velocidex Velociraptor below version 0.76.5, the GetUserRoles gRPC endpoint has an authorization bypass vulnerability (CWE-639). Any authenticated low-privilege user can retrieve the complete ACL policy (roles and permissions) for any user across all organizations by supplying targeted Name and Org parameters.

Rapid7 Velociraptor versions before 0.75.6 contain a directory traversal issue on Linux servers that allows a rogue client to upload a file which is written outside the datastore directory. The issue occurs due to insufficient sanitization of directory names ending with a dot, only encoding the final dot as %2E.