Detections
Analytics

SCA: security update for www.velocidex.com/golang/velociraptor (GHSA-g5vm-525q-r66c)

high Tenable Cloud Security Plugin ID 414907

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - Rapid7 Velociraptor allows users to be created with different privileges on the server. Administrators are
 generally allowed to run any command on the server including writing arbitrary files. However, lower
 privilege users are generally forbidden from writing or modifying files on the server. The VQL copy()
 function applies permission checks for reading files but does not check for permission to write files.
 This allows a low privilege user (usually, users with the Velociraptor "investigator" role) to overwrite
 files on the server, including Velociraptor configuration files. To exploit this vulnerability, the
 attacker must already have a Velociraptor user account at a low privilege level (at least "analyst") and
 be able to log into the GUI and create a notebook where they can run the VQL query invoking the copy() VQL
 function. Typically, most users deploy Velociraptor with limited access to a trusted group (most users
 will be administrators within the GUI). This vulnerability is associated with program files
 https://github.Com/Velocidex/velociraptor/blob/master/vql/filesystem/copy.go
 https://github.Com/Velocidex/velociraptor/blob/master/vql/filesystem/copy.go and program routines copy().
 This issue affects Velociraptor versions before 0.6.7-5. Version 0.6.7-5, released January 16, 2023, fixes
 the issue. (CVE-2023-0242)

See Also

https://github.com/advisories/GHSA-g5vm-525q-r66c

Plugin Details

Severity: High

ID: 414907

Version: Revision 1.9

Type: Local

Family: SCA Checks

Published: 1/23/2025

Updated: 7/2/2026

Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Medium

Score: 4.9

Percentile: 57.12

Vendor

Vendor Severity: High

CVSS v2

Risk Factor: High

Base Score: 9

Temporal Score: 6.7

Vector: CVSS2#AV:N/AC:L/Au:S/C:C/I:C/A:C

CVSS Score Source: CVE-2023-0242

CVSS v3

Risk Factor: High

Base Score: 8.8

Temporal Score: 7.7

Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 1/18/2023

Vulnerability Publication Date: 1/18/2023

Reference Information

CVE: CVE-2023-0242