CyberRota Analysis
AI-GeneratedThe Velociraptor gRPC API's VFSGetBuffer endpoint is vulnerable due to a bypass in the prefix check mechanism, enabling unauthorized users to read sensitive files from the datastore. This flaw can lead to unauthorized access to files across different organizations if the user has read permissions in the ROOT organization. Organizations utilizing the Velociraptor API should prioritize remediation to prevent potential data breaches and unauthorized data exposure.
Original NVD Description
The Velociraptor gRPC API has a VFSGetBuffer endpoint which allows reading files from the datastore. To prevent users from reading sensitive files or accessing other orgs, the requested path is prefix checked against a list of denied prefixes. This prefix check can be bypassed allowing a user to access usually denied files. If the user has read permission in the ROOT org, this allows access to other orgs, in which the user may not have permission.