Insufficient permission check in the VQL copy() function

CVE-2023-0242

What is CVE-2023-0242?

The vulnerability in Rapid7 Velociraptor allows a low privilege user, such as those with the 'investigator' role, to exploit insufficient permission checks in the VQL copy() function. Although administrators can execute any command on the server, the flaw permits unauthorized file overwrites due to a lack of adequate permission verification for writing operations. This means that an attacker, having an account with limited privileges, could overwrite configuration files on the server. The issue affects all Velociraptor versions before 0.6.7-5, which was released to address and rectify this critical issue.

References