Executive brief
Velociraptor is a forensic and incident response platform that allows authorized analysts to perform system investigations and data collection. An authenticated analyst-role user can exploit missing permission checks in three upload plugins to initiate outbound network connections from the server without proper authorization, potentially enabling internal network reconnaissance and data exfiltration to external hosts.
Technical details
The vulnerability is a missing authorization check (CWE-862) in the upload_azure, upload_sftp, and upload_smb VQL plugins. These plugins fail to validate the NETWORK ACL permission before initiating network connections, allowing authenticated analyst-role users to bypass the intended authorization boundary. An attacker with analyst-level access can leverage these plugins to perform port scanning and network reconnaissance of internal systems or establish data exfiltration channels to external endpoints. The issue was patched in version 0.77.2 by adding proper CheckAccess() calls for the NETWORK permission in affected functions, as demonstrated in commit 48824fb.
Affected products
- Velocidex Velociraptor prior to 0.77.2
Timeline
- 2026-08-11: disclosed
- 2026-07-27: patched: Fix committed; release 0.77.2 recommended