Summary
Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in Rapid7 Velociraptor ausnutzen, um seine Privilegien zu erhöhen oder einen Denial of Service zu verursachen.
Product
Rapid7 Velociraptor ist ein Tool zur Endpunkt-Erkennung und -Reaktion (EDR) und zur digitalen Forensik, das eine leistungsstarke Sammlung von Tools zur Überwachung und Analyse von Endpunkten bietet.
Vulnerabilities 3
-
Critical 9.9
Velociraptor Investigator reaches SuperUser via hunt EffectivePrincipal
Velociraptor stores the compiled VQL in the hunt object internally to avoid having to recompile the artifacts for each endpoint in the hunt. Although the field "compiled_collector_args" is an internal field, Velociraptor allowed the field to be set from a use…
-
Medium 6.5
Velociraptor Authenticated Denial of Service
Velociraptor contains a deadlock condition that may be triggered by authenticated users. The issue stems from a lock management bug in the user management module.
-
Low 3.6
Velociraptor Prefetch parser out of bounds
Velociraptor's prefetch library contains an out of bound vulnerability which may cause a crash when parsing certain malformed prefetch files.
Revision history
-
#1
Initiale Fassung
References
-
Velociraptor Security Advisories vom 2026-09-24
https://docs.velociraptor.app/announcements/advisories/cve-2026-19072
-
Velociraptor Security Advisories vom 2026-09-24
https://docs.velociraptor.app/announcements/advisories/cve-2026-77797/
-
Velociraptor Security Advisories vom 2026-09-24
https://docs.velociraptor.app/announcements/advisories/cve-2026-77798/