A critical authorization and code injection vulnerability in Rapid7 Velociraptor allows authenticated users to execute malicious code, potentially compromising the host system.

This issue involves missing authorization (CWE-862) and code injection (CWE-94) within the verify() VQL function. An authenticated user can leverage this function to bypass authorization checks and inject arbitrary code, leading to unauthorized system actions.

With a CVSS score of 8.9, this vulnerability presents a significant risk to the security of the Velociraptor platform and the endpoints it manages. Successful exploitation could allow an attacker to gain elevated control, potentially leading to full system compromise, data theft, or the execution of malicious tasks across the managed fleet.

Immediate Action: Update the Velociraptor deployment to version 0.77.2 or later to address the vulnerable VQL function.

Proactive Monitoring: Monitor VQL execution logs for anomalous or unauthorized calls to the verify() function that originate from non-administrative user accounts.

Compensating Controls: Restrict access to the Velociraptor management interface to authorized personnel only, and implement strict least-privilege access controls for all users interacting with the platform.

Public Exploit Available: No confirmed public exploit available.

The combination of missing authorization and code injection capabilities makes this an urgent security concern. Organizations should update their Velociraptor infrastructure to the patched version as soon as possible to prevent potential exploitation.