CyberRota Analysis
AI-GeneratedVelociraptor has a vulnerability that allows users with the "analyst" role to escalate their privileges to the "investigator" role by executing VQL queries that reset the authorization provider, bypassing the required COLLECT_CLIENT permission for scheduling new collections. This poses a significant risk as it enables unauthorized data collection and potential data exfiltration. Organizations utilizing Velociraptor should prioritize addressing this vulnerability to prevent unauthorized access and maintain data integrity.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Velociraptor allows scheduling new collections via VQL queries in notebooks. For a user to schedule a new collection, they require the COLLECT_CLIENT permission. However, this is not enforced when the user can run a VQL query which resets the authorization provider. This allows a user who can run arbitrary VQL (usually with the "analyst" role) to launch new collections (usually requires the "investigator" role). This vulnerability is an escalation from an analyst to investigator role.