Vulnerabilities

The Rapid7 Metasploit msf-ws suffers from a missing authentication vulnerability whereby the REST API grants an unauthenticated "bootstrap" exemption so that the very first administrator can be created when the users tab…

Improper handling of local filesystem paths in Rapid7 Insight Agent on Linux and macOS may allow authenticated local users to gain elevated privileges.

Metasploit Framework versions before 6.5.7 allow HTTP requests made through send_request_cgi! to follow redirects to a different host without restricting the redirect destination.

The FTP client trusts the server's PASV response IP:port without validation against the control connection target.

The Metasploit Framework Web Service REST API (msf-ws) exposes the credential store through Msf::WebServices::CredentialServlet.

The Metasploit Framework post module post/apple_ios/gather/ios_image_gather is affected by a relative path traversal vulnerability (CWE-22).

Velociraptor allows collection of VQL queries packaged into Artifacts from endpoints.

Velociraptor's SetClientMetadata used the wrong permission check to enforce setting metadata on the server.

Velociraptor's WatchEvent gRPC API can specify the OrgId of the org from which events should be streamed.

Rapid7 Bulk Export MCP versions 0.2.5 through 0.6.1 suffer from a GraphQL query injection issue in the export-status component (`get_export_status` in `src/export_manager.py`), whereby the `export_id` value — an unvalida…

An uncontrolled search path element in InsightVM assessment content in Rapid7 Insight Agent on Windows allows a local, low-privileged user to execute arbitrary code as SYSTEM via a planted executable resolved from the ma…

Velociraptor contains a deadlock condition that may be triggered by authenticated users.

Velociraptor's prefetch library contains an out of bound vulnerability which may cause a crash when parsing certain malformed prefetch files.

Velociraptor stores the compiled VQL in the hunt object internally to avoid having to recompile the artifacts for each endpoint in the hunt.

Velociraptor allows for the creation of notebook backups in its default enabled daily backup feature.

Velociraptor allows some sensitive artifacts to be gated by additional permissions.

A logic vulnerability (fail-open condition) has been identified within the Metasploit Framework's JSON-RPC web service interface.

The Velociraptor verify() VQL function allows a user to verify an artifact for syntatic and other issues.

Velociraptor's web GUI allows specifying a custom type for columns in tables.

Velociraptor allows reading Stacked result sets from the GUI.

A rogue Velociraptor client can upload a malformed sparse file such that if the GUI attempts to expand the file, a panic occurs which may crash the server process.

The hunt_delete() VQL function allows deleting hunts.

When Microsoft Excel imports a CSV file, it executes cells beginning with certain characters as formulas, giving such CSV files arbitrary execution.

Velociraptor allows scheduling new collections via VQL queries in notebooks.

When Velociraptor is configured to use an OIDC IdP for authentication, it uses the email claim as a username.