Insufficient permission check in the VQL copy() function
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- Privilege escalation, Security bypass
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA and GitHub. Impact type from CWE-269 and CWE-862.
Summary
Rapid7 Velociraptor allows users to be created with different privileges on the server. Administrators are generally allowed to run any command on the server including writing arbitrary files. However, lower privilege users are generally forbidden from writing or modifying files on the server. The VQL copy() function applies permission checks for reading files but does not check for permission to write files. This allows a low privilege user (usually, users with the Velociraptor "investigator" role) to overwrite files on the server, including Velociraptor configuration files. To exploit this vulnerability, the attacker must already have a Velociraptor user account at a low privilege level (at least "analyst") and be able to log into the GUI and create a notebook where they can run the VQL query invoking the copy() VQL function. Typically, most users deploy Velociraptor with limited access to a trusted group (most users will be administrators within the GUI). This vulnerability is associated with program files https://github.Com/Velocidex/velociraptor/blob/master/vql/filesystem/copy.go https://github.Com/Velocidex/velociraptor/blob/master/vql/filesystem/copy.go and program routines copy(). This issue affects Velociraptor versions before 0.6.7-5. Version 0.6.7-5, released January 16, 2023, fixes the issue.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Rapid7 | Velociraptor | before 0.6.7-5 | 0.6.7-5 | Patch available | CNA |
| — | www.velocidex.com/golang/velociraptor (Go) | before 0.6.7-5 | 0.6.7-5 | Patch available | GHSA-g5vm-525q-r66c |
- Velociraptor VendorRapid7 Affected before 0.6.7-5 Fixed in 0.6.7-5 Patch available CNA
- www.velocidex.com/golang/velociraptor (Go) Vendor— Affected before 0.6.7-5 Fixed in 0.6.7-5 Patch available GHSA-g5vm-525q-r66c
Remediation
- Fix · CNA Velociraptor (Rapid7) Fixed in 0.6.7-5
- Fix · GHSA-g5vm-525q-r66c www.velocidex.com/golang/velociraptor (Go) Fixed in 0.6.7-5 Advisory →
Fixed in the same release
Records fixed by the same vendor advisory or release, as the CNA lists them.
- Release ·
Rapid7 Velociraptor 0.6.7-5
2 records Highest priority Priority LOW 2 LOW
Other records, highest priority first
- TI-2023-00275 Rapid7 Velociraptor directory traversal in client ID parameterPriority LOW 21
Timeline
- 2026-10-02 Threatist record created from CVE-2023-0242
- 2026-10-03 Alias added: GHSA-g5vm-525q-r66c
References
More Rapid7 Velociraptor vulnerabilities
- TI-2023-05481 Rapid7 Velociraptor Reflected XSS CVSS 3.1HIGH 8.6
- TI-2026-05514 Velociraptor Query() Plugin Misapplies Permissions To Orgs CVSS 3.1CRITICAL 9.1
- TI-2026-04661 Rapid7 Velociraptor Improper Input Validation in Client Message Handler CVSS 3.1HIGH 8.5
- TI-2026-06659 GetUserRoles API endpoint allows any authenticated user to enumerate ACL policies across all organizations CVSS 3.1HIGH 7.7
- TI-2025-13446 Rapid7 Velociraptor Directory Traversal Vulnerability CVSS 3.1MEDIUM 6.8
- TI-2025-05666 Velociraptor priviledge escalation via UpdateConfig artifact CVSS 3.1MEDIUM 5.5
Sources
- CVE-2023-0242 · CVE Program
- CVE-2023-0242 · NVD
- FIRST EPSS
- GHSA-g5vm-525q-r66c · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences