A critical vulnerability in Rapid7 Velociraptor allows authenticated users with investigator privileges to escalate their access to arbitrary command execution and full endpoint takeover.

This flaw involves an incorrect default permissions issue within the Admin.Client.UpdateClientConfig artifact, which fails to enforce necessary permission checks. An authenticated user possessing the COLLECT_CLIENT permission, typically assigned to the Investigator role, can exploit this to update client configurations and execute arbitrary commands on target endpoints.

The exploitation of this vulnerability leads to a total compromise of the affected endpoint, as an attacker can gain full control over the system configuration and execute arbitrary code. Given the CVSS score of 9.5, this represents a critical risk to organizational infrastructure, potentially allowing threat actors to maintain persistent access or deploy ransomware across the network. The ability to perform endpoint takeover makes this a high-priority concern for any security team utilizing Velociraptor for incident response or monitoring.

Immediate Action: Update all instances of Velociraptor to version 0.74.3 or later to ensure the proper permission checks are enforced for the affected artifact.

Proactive Monitoring: Monitor audit logs for unusual activity associated with the Admin.Client.UpdateClientConfig artifact or unexpected changes to client configurations by accounts with the Investigator role.

Compensating Controls: Restrict access to the Investigator role and limit the ability of users to collect artifacts from sensitive endpoints until the patch can be applied.

Public Exploit Available: Yes, multiple proof-of-concept exploits are publicly available.

Given the critical nature of this vulnerability and the availability of proof-of-concept exploits, immediate remediation is required. Security teams should prioritize upgrading to version 0.74.3 to close the permission gap and prevent potential endpoint takeover. Failure to apply this patch leaves the management platform open to significant administrative compromise and lateral movement by malicious actors.