Rapid7 Velociraptor MSI Installer versions below 0.73.3 suffer from a vulnerability whereby it creates the installation directory with WRITE_DACL permission to the BUILTIN\\Users group. This allows local users who are not administrators to grant themselves the Full Control permission on Velociraptor's files. By modifying Velociraptor's files, local users can subvert the binary and cause the Velociraptor service to execute arbitrary code as the SYSTEM user, or to replace the Velociraptor binary completely.  This issue is fixed in version 0.73.3.
History

Thu, 07 Nov 2024 19:15:00 +0000

Type Values Removed Values Added
First Time appeared Rapid7
Rapid7 velociraptor
CPEs cpe:2.3:a:rapid7:velociraptor:*:*:*:*:*:*:*:*
Vendors & Products Rapid7
Rapid7 velociraptor
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}


Thu, 07 Nov 2024 10:45:00 +0000

Type Values Removed Values Added
Description Rapid7 Velociraptor MSI Installer versions below 0.73.3 suffer from a vulnerability whereby it creates the installation directory with WRITE_DACL permission to the BUILTIN\\Users group. This allows local users who are not administrators to grant themselves the Full Control permission on Velociraptor's files. By modifying Velociraptor's files, local users can subvert the binary and cause the Velociraptor service to execute arbitrary code as the SYSTEM user, or to replace the Velociraptor binary completely.  This issue is fixed in version 0.73.3.
Title Rapid7 Velociraptor Local Privilege Escalation In Windows Velociraptor Service
Weaknesses CWE-552
CWE-732
References
Metrics cvssV4_0

{'score': 8.6, 'vector': 'CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/AU:Y/R:U/V:D/RE:L/U:Red'}


cve-icon MITRE

Status: PUBLISHED

Assigner: rapid7

Published: 2024-11-07T10:18:05.530Z

Updated: 2024-11-07T18:31:26.561Z

Reserved: 2024-10-30T10:22:28.725Z

Link: CVE-2024-10526

cve-icon Vulnrichment

Updated: 2024-11-07T18:31:21.550Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2024-11-07T11:15:03.973

Modified: 2024-11-08T19:01:03.880

Link: CVE-2024-10526

cve-icon Redhat

No data.