Insufficient permission check in the VQL copy() function

CVE-2023-0242

What is CVE-2023-0242?

The vulnerability in Rapid7 Velociraptor allows a low privilege user, such as those with the 'investigator' role, to exploit insufficient permission checks in the VQL copy() function. Although administrators can execute any command on the server, the flaw permits unauthorized file overwrites due to a lack of adequate permission verification for writing operations. This means that an attacker, having an account with limited privileges, could overwrite configuration files on the server. The issue affects all Velociraptor versions before 0.6.7-5, which was released to address and rectify this critical issue.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References