CVE-2024-10526

Rapid7 Velociraptor Local Privilege Escalation In Windows Velociraptor Service

State: Published
Severity: 8.6 High
Published: Nov 7, 2024
Updated: Nov 7, 2024
Reserved: Oct 30, 2024

Description

Rapid7 Velociraptor MSI Installer versions below 0.73.3 suffer from a vulnerability whereby it creates the installation directory with WRITE_DACL permission to the BUILTIN\\Users group. This allows local users who are not administrators to grant themselves the Full Control permission on Velociraptor's files. By modifying Velociraptor's files, local users can subvert the binary and cause the Velociraptor service to execute arbitrary code as the SYSTEM user, or to replace the Velociraptor binary completely. This issue is fixed in version 0.73.3.

Scores

CVSS	Score	Vector	Source
4.0	8.6 High	CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/AU:Y/R:U/V:D/RE:L/U:Red	rapid7

Weaknesses

CWE-552 Files or Directories Accessible to External Parties
CWE-732 Incorrect Permission Assignment for Critical Resource

Affected Products

Product	Versions
VelociraptorRapid7	<0.73.2Affected

References

https://docs.velociraptor.app/announcements/2024-cves/

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.