Velociraptor Hunt Deletion Permission Bypass

Executive Summary

This vulnerability involves the hunt_delete() function in Velociraptor, a digital forensics tool. The function allows deleting hunts but incorrectly checks for only COLLECT_CLIENT permission instead of DELETE_RESULTS. This means users with investigator-level access can delete hunts, which should require administrator privileges.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, review Velociraptor server logs for unauthorized use of the hunt_delete() function. Check for users with COLLECT_CLIENT permission performing delete operations typically requiring DELETE_RESULTS. Examine audit logs for suspicious hunt deletions.

Useful 0 Not Useful 0

Impact Analysis

An attacker with investigator-level access could delete hunts, potentially removing critical forensic data or evidence. This compromises data integrity and could hinder incident response efforts by erasing important investigation trails.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade Velociraptor to version 0.77.2 or later. Review and restrict COLLECT_CLIENT permissions to prevent unauthorized hunt deletions. Audit existing user permissions and remove DELETE_RESULTS access from non-administrative roles.

Useful 0 Not Useful 0