SUSE CVE-2023-0290

Rapid7 Velociraptor did not properly sanitize the client ID parameter to the CreateCollection API, allowing a directory traversal in where the collection task could be written. It was possible to provide a client id of "../clients/server" to schedule the collection for the server as a server...

PT-2023-16146 · Rapid7 · Rapid7 Velociraptor

Name of the Vulnerable Software and Affected Versions: Rapid7 Velociraptor versions prior to 0.6.7-5 Description: The issue allows a directory traversal where the collection task could be written by not properly sanitizing the client ID parameter to the "CreateCollection API". This could be...