Executive Summary

This vulnerability is a directory traversal issue in Rapid7 Velociraptor versions before 0.75.6 on Linux servers. It allows a rogue client to upload a file that is written outside the intended datastore directory due to insufficient sanitization of directory names ending with a dot ('.'). The final dot is encoded as '%2E', which enables writing files outside the allowed directory.

Useful 0 Not Useful 0

Impact Analysis

The vulnerability can allow an attacker to write files outside the designated datastore directory, potentially leading to unauthorized file placement. However, the impact is limited because the containing directory must end with '%2E', which prevents overwriting critical files. The vulnerability can cause integrity issues but does not affect confidentiality or availability.

Useful 0 Not Useful 0

Detection Guidance

Detection involves monitoring for unusual file uploads or files written outside the Velociraptor datastore directory on Linux servers running versions prior to 0.75.6. Since exploitation requires directory names ending with '%2E', scanning for files or directories with names ending in '%2E' outside the datastore directory may help identify attempts. Specific commands are not provided in the available resources. [1]

Useful 0 Not Useful 0

Mitigation Strategies

The immediate mitigation step is to upgrade Velociraptor on Linux servers to version 0.75.6 or later, which contains the fix for this directory traversal vulnerability. Windows servers are not affected and do not require action. [1]

Useful 0 Not Useful 0