An authenticated privilege escalation vulnerability in Rapid7 Velociraptor allows low-privileged users to execute arbitrary code as an administrator, posing a critical risk to server integrity.

The application improperly exposes an internal field, compiled_collector_args, to user API calls, allowing an investigator to bypass access control lists and execute arbitrary VQL statements. This flaw essentially permits a user with investigator-level privileges to escalate their authority to that of an administrator.

Successful exploitation of this vulnerability results in full administrative compromise of the Velociraptor server. Given the CVSS score of 9.9, this represents a critical risk where an attacker can gain complete control over the platform, potentially leading to unauthorized data access, system-wide configuration changes, or the deployment of malicious artifacts across managed endpoints.

Immediate Action: Update Rapid7 Velociraptor to version 0.77.2 or later to apply the necessary patches and secure the vulnerable API endpoint.

Proactive Monitoring: Review API access logs for anomalous requests, specifically targeting the scheduling of hunts or modifications to hunt object parameters by investigator-level accounts.

Compensating Controls: Implement strict role-based access control (RBAC) to limit the number of users with investigator privileges and consider restricting API access to known, trusted management IP addresses.

Public Exploit Available: No (exploit_available: false)

The severity of this vulnerability, combined with the potential for total administrative takeover, necessitates immediate attention. Organizations utilizing Velociraptor must prioritize upgrading to version 0.77.2 to eliminate the risk of privilege escalation and ensure the continued security of the platform.