Authentication Bypass via OIDC Email Claim in Velociraptor

Executive Summary

This vulnerability affects Velociraptor when configured with an OIDC Identity Provider (IdP) for authentication. Velociraptor uses the email claim as a username, but some IdPs allow users to change this claim without verification or lack the 'email_verified' claim. This enables attackers to impersonate other users by setting a different email address, leading to account takeover.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, check if Velociraptor is configured to use an OIDC IdP that allows email claim changes without verification. Review IdP settings for email verification requirements and Velociraptor configuration files for email claim usage. No specific commands are provided in the context.

Useful 0 Not Useful 0

Impact Analysis

An attacker could impersonate a legitimate user by changing their email claim in the IdP, gaining unauthorized access to the Velociraptor system. This could lead to data breaches, unauthorized actions, or further exploitation of the system depending on user privileges.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access, potentially violating data protection requirements under GDPR or HIPAA. It may result in unauthorized data exposure or modification, compromising compliance with these regulations.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately update Velociraptor to version 0.77.2 or later. Modify the Velociraptor configuration to use a more permanent claim like 'upn' or 'oid' instead of the email claim for username assignment. Ensure the IdP enforces email verification or disable self-enrollment modes.

Useful 0 Not Useful 0