Lucene search

Rapid7CVE-2023-2226

HistoryApr 21, 2023 - 12:15 p.m.

CVE-2023-2226

2023-04-2112:15:07

CWE-125

rapid7

web.nvd.nist.gov

cve-2023-2226

information security

rapid7

velociraptor

parsing

validation

malicious files

vulnerability

attack

CVSS3

5.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

LOW

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

AI Score

5.2

Confidence

High

EPSS

0.001

Percentile

17.2%

JSON

Due to insufficient validation in the PE and OLE parsers in Rapid7’s Velociraptor versions earlier than 0.6.8 allows attacker to crash Velociraptor during parsing of maliciously malformed files.

For this attack to succeed, the attacker needs to be able to introduce malicious files to the system at the same time that Velociraptor attempts to collect any artifacts that attempt to parse PE files, Authenticode signatures, or OLE files. After crashing, the Velociraptor service will restart and it will still be possible to collect other artifacts.

Affected configurations

Nvd

Node

rapid7velociraptorRange<0.6.8

VendorProductVersionCPE
rapid7velociraptor*cpe:2.3:a:rapid7:velociraptor:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
rapid7	velociraptor	*	cpe:2.3:a:rapid7:velociraptor::::::::

CNA Affected

[
  {
    "collectionURL": "https://github.com/Velocidex/velociraptor/releases",
    "defaultStatus": "unaffected",
    "modules": [
      "PE Parser",
      "OLE parser",
      "Authenticode parser"
    ],
    "packageName": "Velociraptor",
    "platforms": [
      "Windows"
    ],
    "product": "Velociraptor",
    "repo": "https://github.com/Velocidex/velociraptor/",
    "vendor": "Rapid7",
    "versions": [
      {
        "lessThan": "0.6.8",
        "status": "affected",
        "version": "0",
        "versionType": "semver"
      }
    ]
  }
]

References

github.com/Velocidex/velociraptor

CVSS3

5.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

LOW

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

AI Score

5.2

Confidence

High

EPSS

0.001

Percentile

17.2%

JSON

Related for CVE-2023-2226