CyberRota Analysis
AI-GeneratedVelociraptor's daily backup feature is vulnerable, allowing users with NOTEBOOK_EDITOR permissions to inject malicious VQL queries into notebook backups. When these backups are restored, the queries are executed with elevated privileges, potentially compromising the system's integrity. Organizations using Velociraptor should prioritize addressing this vulnerability to prevent unauthorized access and exploitation.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Velociraptor allows for the creation of notebook backups in its default enabled daily backup feature. When Velociraptor restores the backup, the notebook cell content is interpolated into a template with no ACL checks. This allows a malicious user with NOTEBOOK_EDITOR permission to plant a VQL query which will be evaluated at elevated permissions if the notebook's backup is subsequently restored.