Summary
Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in Rapid7 Velociraptor ausnutzen, um Dateien zu manipulieren, Sicherheitsmaßnahmen zu umgehen, erweiterte Berechtigungen zu erlangen und vertrauliche Informationen offenzulegen.
Product
Rapid7 Velociraptor ist ein Tool zur Endpunkt-Erkennung und -Reaktion (EDR) und zur digitalen Forensik, das eine leistungsstarke Sammlung von Tools zur Überwachung und Analyse von Endpunkten bietet.
Vulnerabilities 3
-
Medium 6.5
Velociraptor Server Metadata update with Insufficient Permission Check
Velociraptor's SetClientMetadata used the wrong permission check to enforce setting metadata on the server. This allows a user with LABEL_CLIENTS permission to update the server metadata. Server metadata is often used to store site wide configuration data tha…
-
Medium 5.5
Velociraptor privilege escalation via SysmonLogForward client monitoring artifact
Velociraptor allows collection of VQL queries packaged into Artifacts from endpoints. These artifacts can be used to do anything and usually run with elevated permissions. To limit access to some dangerous artifact, Velociraptor allows for those to require hi…
-
Medium 4.9
WatchEvent API streams another organization's live events
Velociraptor's WatchEvent gRPC API can specify the OrgId of the org from which events should be streamed. The server checks the API permissions against the caller's Org instead of the requested Org. This allows a user with API access in one org to read events…
Revision history
-
#2
Referenz-Links korrigiert
-
#1
Initiale Fassung
References
-
Velociraptor Security Advisories vom 2026-10-04
https://docs.velociraptor.app/announcements/advisories/cve-2026-78411/
-
Velociraptor Security Advisories vom 2026-10-04
https://docs.velociraptor.app/announcements/advisories/cve-2026-78412/
-
Velociraptor Security Advisories vom 2026-10-04
https://docs.velociraptor.app/announcements/advisories/cve-2026-78413/