CVE-2025-6264: Rapid7 Velociraptor Incorrect Default Permissions Vulnerability
Rapid7 Velociraptor contains an incorrect default permissions vulnerability that can lead to arbitrary command execution and endpoint takeover. To successfully exploit this vulnerability the user must already have access to collect artifacts from the endpoint.
Other sources
Velociraptor allows collection of VQL queries packaged into Artifacts from endpoints. These artifacts can be used to do anything and usually run with elevated permissions. To limit access to some dangerous artifact, Velociraptor allows for those to require high permissions like EXECVE to launch.
The Admin.Client.UpdateClientConfig is an artifact used to update the client's configuration. This artifact did not enforce an additional required permission, allowing users with COLLECTCLIENT permissions (normally given by the "Investigator" role) to collect it from endpoints and update the configuration.
This can lead to arbitrary command execution and endpoint takeover.
To successfully exploit this vulnerability the user must already have access to collect artifacts from the endpoint (i.e. have the COLLECTCLIENT given typically by the "Investigator' role).
— GitHub
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
go/www.velocidex.com/golang/velociraptorto a version that resolves this vulnerability.Fixed in 0.74.3
Event History
Frequently Asked Questions
What is the severity of CVE-2025-6264?
CVE-2025-6264 is considered a high severity vulnerability due to the potential for elevated permissions and unrestricted access to sensitive artifacts.
How do I fix CVE-2025-6264?
To remediate CVE-2025-6264, ensure your Velociraptor version is updated to 0.74.4 or later to mitigate the risks associated with artifact permissions.
What systems are affected by CVE-2025-6264?
CVE-2025-6264 affects Velociraptor versions up to and including 0.74.3.
What risks does CVE-2025-6264 pose?
CVE-2025-6264 allows unauthorized execution of potentially harmful VQL queries with elevated permissions, which can compromise system integrity and security.
Who can exploit CVE-2025-6264?
CVE-2025-6264 can be exploited by any user with access to the Velociraptor platform and the knowledge to execute malicious VQL queries.