CVE-2024-10526
Rapid7 Velociraptor Local Privilege Escalation In Windows Velociraptor Service
We use these services and cookies to improve your user experience. You may opt out if you wish, however, this may limit some features on this site.
Please see our statement on Data Privacy.
Rapid7 Velociraptor Local Privilege Escalation In Windows Velociraptor Service
Rapid7 Velociraptor MSI Installer versions below 0.73.3 suffer from a vulnerability whereby it creates the installation directory with WRITE_DACL permission to the BUILTIN\\Users group. This allows local users who are not administrators to grant themselves the Full Control permission on Velociraptor's files. By modifying Velociraptor's files, local users can subvert the binary and cause the Velociraptor service to execute arbitrary code as the SYSTEM user, or to replace the Velociraptor binary completely. This issue is fixed in version 0.73.3.
Reserved 2024-10-30 | Published 2024-11-07 | Updated 2024-11-07 | Assigner rapid7CWE-552 Files or Directories Accessible to External Parties
CWE-732 Incorrect Permission Assignment for Critical Resource
Jean-Baptiste Mesnard-Sense from Synackti
docs.velociraptor.app/announcements/2024-cves/
Support options
