Security Advisories on Velociraptor - Digging deeper!

CVE-2025-14728 Velociraptor directory traversal vulnerability

Sat, 20 Dec 2025 00:00:00 +0000

Published on 2025-12-29

Rapid7 Velociraptor versions before 0.75.6 contain a directory traversal issue on Linux servers that allows a rogue client to upload a file which is written outside the datastore directory. Velociraptor is normally only allowed to write in the datastore directory. The issue occurs due to insufficient sanitization of directory names which end with a ".", only encoding the final "." as "%2E".

Although files can be written to incorrect locations, the containing directory must end with "%2E". This limits the impact of this vulnerability, and prevents it from overwriting critical files.

Required configuration for exposure:

This vulnerability only occurs on Velociraptor servers running on Linux (which is the common and recommended configuration). Velociraptor servers running on Windows are not affected.

Problem:

CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') CWE-22

Impact:

CAPEC-23 File Content Injection CAPEC-23

Product Status:

Product	Affected
Rapid7 Velociraptor on Linux source repo Default status is unaffected	before 0.75.6

Credits:

We thank @_chebuya for identifying and reporting this issue

References

docs.velociraptor.app/announcements/advisories/cve-2025-14728/

Further details

When Velociraptor receives an uploaded file from the client, the server writes the file into the client’s part of the datastore directory. The path under which the file is written is made to resemble the original path on the client as much as possible, except that certain characters are escaped.

For example, if the path contains a “:” character (e.g. C:\Windows) this is escaped since this character is not representable on a Windows filesystem. Additionally, velociraptor escapes directory traversal sequences like ...

On Windows, filenames that end with a “.” are not representable, with windows silently dropping the final “.” from the filename. This causes corruption when the server runs on Windows.

In the specific case of a path component that ends with a “.”, Velociraptor escapes the final “.” to “%2E”, but neglects to escape other directory traversal characters in that path component. This results in some directory traversal characters being propagated into the path itself.

The vulnerability allows a rogue client to upload files to unintended directories on the server, as long as the containing directory name ends with a “%2E”.

On Windows, Velociraptor uses raw device paths which do not support directory traversal at all. Therefore, this vulnerability is not exploitable on Windows. (e.g. \\?\C:\datastore\clients\C.1234\..\test.txt is not a valid path)

Recommendation

This vulnerability requires upgrading the server as described in Server Upgrades.

On Windows the vulnerability is not exploitable.
If running the 0.75 release on a Linux server, please use the velociraptor-v0.75.6-linux-amd64 release.
If running the 0.74 release on a Linux server, please use the velociraptor-v0.74.6-linux-amd64 release.

Older versions are vulnerable and should be upgraded immediately.

CVE-2025-6264 Velociraptor priviledge escalation via UpdateConfig artifact

Wed, 18 Jun 2025 00:00:00 +0000

Published on 2025-06-19

Velociraptor allows collection of VQL queries packaged into Artifacts from endpoints. These artifacts can be used to do anything and usually run with elevated permissions. To limit access to some dangerous artifact, Velociraptor allows for those to require high permissions like EXECVE to launch.

The Admin.Client.UpdateClientConfig is an artifact used to update the client's configuration. This artifact did not enforce an additional required permission, allowing users with COLLECT_CLIENT permissions (normally given by the "Investigator" role) to collect it from endpoints and update the configuration.

This can lead to arbitrary command execution and endpoint takeover.

To successfully exploit this vulnerability the user must already have access to collect artifacts from the endpoint (i.e. have the COLLECT_CLIENT given typically by the "Investigator' role).

Required configuration for exposure:

Users who rely on artifacts to prevent dangerous actions from already privileged users.

Problem:

CWE-276 Incorrect Default Permissions CWE-276

Impact:

CAPEC-23 File Content Injection CAPEC-23

Product Status:

Product	Affected
Rapid7 Velociraptor on Windows, MacOS, Linux source repo Default status is unaffected	before 0.74.3

Workaround:

To better restrict the types of artifacts users can run, the `basic artifacts` mechanism should be used as described https://docs.velociraptor.app/docs/artifacts/security/#basic-artifacts

To detect unintended privilege escalations in custom artifacts, users should run the artifact verifier as described here https://docs.velociraptor.app/docs/artifacts/security/#restricting-dangerous-client-artifacts

Credits:

We thank Christian Fünfhaus from Deutsche Bahn CSIRT for identifying and reporting this issue

References

docs.velociraptor.app/announcements/advisories/cve-2025-6264/

CVE-2025-0914 Velociraptor Shell Plugin prevent_execve bypass

Tue, 25 Feb 2025 00:00:00 +0000

Publishedon 2025-02-25

An improper access control issue in the VQL shell feature in Velociraptor Versions < 0.73.4 allowed authenticated users to execute the execve() plugin in deployments where this was explicitly forbidden by configuring the prevent_execve flag in the configuration file.

This setting is not usually recommended and is uncommonly used, so this issue will only affect users who do set it.

This issue is fixed in release 0.73.4

Required configuration for exposure:

Requires the prevent_execve option to be enabled.

Problem:

CWE-281 Improper Preservation of Permissions CWE-281

Impact:

CAPEC-176 Configuration/Environment Manipulation CAPEC-176

Exploits:

Using the query() plugin it is possible to run the execve() plugin on systems where the prevent_execve configuration parameter is set.

Product Status:

Product	Affected
Rapid7 Velociraptor on Windows, MacOS, Linux, x86, ARM, 64 bit, 32 bit Default status is unaffected	before 0.73.4

Solution:

Upgrade endpoint agent to release 0.73.4

Credits:

Darragh O'Reilly, SUSE

References

docs.velociraptor.app/announcements/advisories/CVE-2025-0914/

CVE-2024-10526 Local Privilege Escalation In Windows Velociraptor Service

Sun, 03 Nov 2024 00:00:00 +0000

Published on 2024-11-03

x_open-source

The Velociraptor Windows MSI installer creates the installation directory with WRITE_DACL permission to the BUILTIN\Users group. This allows local users who are not administrators to grant themselves the Full Control permission on Velociraptor's files. By modifying Velociraptor's files, local users can subvert the binary and cause the Velociraptor service to execute arbitrary code as the SYSTEM user, or to replace the Velociraptor binary completely.

Problem:

CWE-552 Files or Directories Accessible to External Parties CWE-552
CWE-732 Incorrect Permission Assignment for Critical Resource CWE-732

Impact:

CAPEC-165 File Manipulation CAPEC-165
CAPEC-233 Privilege Escalation CAPEC-233

Product Status:

Product	Affected
Rapid7 Velociraptor » MSI Installer on Windows source repo https://github.com/Velocidex/velociraptor/blob/master/docs/wix/velociraptor_amd64.xml Default status is unaffected	before 0.73.3 (unaffected from 0.73.3)

Solution:

For new installs use the updated MSI. If you do not wish to upgrade the endpoint client at this time, please arrange to run the icacls.exe command sequence described below at the earliest time.

Workaround:

In the Velociraptor start a hunt over all your Windows Assets, select the Windows.System.PowerShell artifact and paste the following in the Command parameter:


    icacls.exe "c:\Program Files\Velociraptor" /inheritance:d /t /c
    icacls.exe "c:\Program Files\Velociraptor" /remove builtin\users /t /c

This hunt will update the ACLs on the Velociraptor directory to remove all BUILTIN\Users permissions.

To verify the correct permissions after a new MSI install, use the following command


    C:> icacls "c:\Program Files\Velociraptor"
    c:\Program Files\Velociraptor BUILTIN\Users:(OI)(CI)(DENY)(S)
                                  BUILTIN\Administrators:(OI)(CI)(F)
                                  NT AUTHORITY\SYSTEM:(OI)(CI)(F)

    Successfully processed 1 files; Failed processing 0 files

This should show a DENY rule for BUILTIN\Users

If applying the commands above, all permissions will be removed for the builtin\users group


    C:> icacls "c:\Program Files\Velociraptor
    c:\Program Files\Velociraptor BUILTIN\Administrators:(OI)(CI)(F)
                                  NT AUTHORITY\SYSTEM:(OI)(CI)(F)

    Successfully processed 1 files; Failed processing 0 files

Credits:

We thank Jean-Baptiste Mesnard-Sense from SYNACKTIV for identifying and reporting this issue

Timeline:

2024-10-28 - Initial Notification by SYNACKTIV
2024-11-03 - 0.73.3 was released to address this issue and an advisory published on Velociraptor's website.

References

docs.velociraptor.app/announcements/advisories/

CVE-2023-5950 Rapid7 Velociraptor Reflected XSS

Mon, 06 Nov 2023 00:00:00 +0000

Published on 2023-11-06

Rapid7 Velociraptor versions prior to 0.7.0-4 suffer from a reflected cross site scripting vulnerability. This vulnerability allows attackers to inject JS into the error path, potentially leading to unauthorized execution of scripts within a user's web browser. This vulnerability is fixed in version 0.7.0-4 and a patch is available to download. Patches are also available for version 0.6.9 (0.6.9-1)
This issue affects the server only.

Problem:

CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') CWE-79

Product Status:

Product	Affected
Rapid7 Velociraptor	before 0.7.0-4

Credits:

Mathias Kujala

References

docs.velociraptor.app/blog/2023/2023-07-27-release-notes-0.7.0/

Timeline:

2023-11-02 - Notification of the issue
2023-11-06 - Release 0.7.0-4 made available on GitHub

CVE-2023-2226 Velociraptor crashes while parsing some malformed PE or OLE files

Fri, 21 Apr 2023 00:00:00 +0000

Published on 2023-04-21

Due to insufficient validation in the PE and OLE parsers in Rapid7's Velociraptor versions earlier than 0.6.8 allows attacker to crash Velociraptor during parsing of maliciously malformed files.

For this attack to succeed, the attacker needs to be able to introduce malicious files to the system at the same time that Velociraptor attempts to collect any artifacts that attempt to parse PE files, Authenticode signatures, or OLE files. After crashing, the Velociraptor service will restart and it will still be possible to collect other artifacts.

Problem:

CWE-125 Out-of-bounds Read CWE-125

Impact:

CAPEC-540 Overread Buffers CAPEC-540

Affected Product Status:

Product	Affected
Rapid7 Velociraptor » PE Parser, OLE parser, Authenticode parser on Windows package repo source repo Default status is unaffected	before 0.6.8

Solution:

Upgrade the clients to version 0.6.8-2

Credits:

Thanks to b1tg https://github.com/b1tg for reporting these issues and providing samples that trigger the crashes

CVE-2023-0242 Insufficient Permission Check In The VQL Copy() Function

Wed, 18 Jan 2023 00:00:00 +0000

Published on 2023-01-18

Improper Privilege Management vulnerability in Rapid7 Velociraptor in the copy() function.

Velociraptor allows users to be created with different privileges on the server. Administrators are generally allowed to run any command on the server including writing arbitrary files. However, lower privilege users are generally forbidden from writing or modifying files on the server.

The VQL copy() function applies permission checks for reading files but does not check for permission to write files. This allows a low privilege user (e.g. users with the Velociraptor "investigator" role) to overwrite files on the server, including Velociraptor configuration files.

To exploit this vulnerability, the attacker must already have a Velociraptor user account at a low privilege level (at least "analyst"). Be able to log into the GUI and create a notebook where they can run the VQL query invoking the copy() VQL function. Typically most users deploy Velociraptor with limited access to a trusted group (most users will be administrators within the GUI).

This vulnerability is associated with program files https://github.Com/Velocidex/velociraptor/blob/master/vql/filesystem/copy.go and program routines copy().

This issue affects Velociraptor: before 0.6.7-5.

Required configuration for exposure:

Velociraptor deployment with multiple users at lower roles than administrators (e.g. "investigator" and above)

Problem:

CWE-269 Improper Privilege Management CWE-269

Impact:

CAPEC-75 Manipulating Writeable Configuration Files CAPEC-75

Product Status:

Product	Affected
Rapid7 Velociraptor » VQL copy() function on Linux, Windows, MacOS, 64 bit, 32 bit package repo source repohttps://github.com/Velocidex/velociraptor/blob/master/vql/filesystem/copy.gocopy() Default status is unaffected	before 0.6.7-5 (unaffected from 5)

Solution:

Upgrade to 0.6.7-5

Workaround:

A valid workaround is to prevent the copy function in the Velociraptor allow list:

1. In the configuration wizard answer yes to the question "Do you want to restrict VQL functionality on the server?"
2. This will add a default allow list to the configuration file.
3. Copy this allow list to your existing server.config.yaml
4. Ensure the "copy" function is removed from the default allow list.

Credits:

Paul Alkemade from Telstra

Timeline:

2023-01-12 - Notification of the issue
2023-01-17 - Release 0.6.7-5 made available on GitHub

CVE-2023-0290 Directory Traversal In Client Id Parameter

Tue, 17 Jan 2023 00:00:00 +0000

Published on 2023-01-17

Velociraptor did not properly sanitize the client id parameter to the CreateCollection API allowing a directory traversal in where the collection task could be written. It was possible to provide a client id of "../clients/server" to schedule the collection for the server (as a server artifact), but only require privileges to schedule collections on the client.

Normally to schedule an artifact on the server requires the COLLECT_SERVER permissions (normally only granted to "administrator" role), but due to this issue it is sufficient to have the COLLECT_CLIENT privilege (normally granted to the "investigator" role)

To exploit this vulnerability, the attacker must already have a Velociraptor user account at a low privilege level (not administrator but at least "investigator"). Be able to authenticate to the GUI (e.g. via OAuth2) and issue an API call to the backend. Typically most users deploy Velociraptor with limited access to a trusted group (most users will be administrators within the GUI).

This vulnerability is associated with program files https://github.Com/Velocidex/velociraptor/blob/master/services/launcher/launcher.go and program routines ScheduleArtifactCollection().

This issue affects Velociraptor: before 0.6.7-5.

Required configuration for exposure:

Velociraptor deployment with multiple users at lower roles than administrators (e.g. "investigators")

Problem:

CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') CWE-22

Impact:

CAPEC-233 Privilege Escalation CAPEC-233

Product Status:

Product	Affected
Rapid7 Velociraptor » CreateCollection API on Windows, Linux, MacOS, 64 bit, 32 bit package repo source repohttps://github.com/Velocidex/velociraptor/blob/master/services/launcher/launcher.goScheduleArtifactCollection() Default status is unaffected	before 0.6.7-5 (unaffected from 5)

Solution:

Upgrade to 0.6.7-5

Credits:

Paul Alkemade from Telstra

Timeline:

2023-01-13 - Notification of the issue
2023-01-17 - Release 0.6.7-5 made available on GitHub