CVE-2024-10526
CVE-2024-10526: Rapid7 Velociraptor MSI Installer vulnerability allows local users to gain unauthorized control. Versions prior to 0.73.3 incorrectly grant WRITE_DACL permission to the BUILTIN\Users group during installation. This flaw enables non-administrator users to assign themselves full control over Velociraptor's files, potentially leading to arbitrary code execution as the SYSTEM user. Even though the SVRS is only 36, indicating a low risk, the ability to subvert the Velociraptor service is a critical security concern. By modifying or replacing Velociraptor binaries, attackers could compromise the entire system. Upgrade to version 0.73.3 or later to mitigate this vulnerability and prevent potential privilege escalation attacks. The presence of the "In The Wild" tag suggests that this vulnerability has been actively exploited, underscoring the importance of patching.
Description
CVE-2024-10526 affects Rapid7 Velociraptor MSI Installer versions below 0.73.3. It allows local users who are not administrators to gain Full Control permission over Velociraptor's files, potentially leading to arbitrary code execution as the SYSTEM user or complete binary replacement. The SVRS of 46 indicates a moderate risk, requiring attention and timely mitigation.
Key Insights
- Privilege Escalation: The vulnerability enables non-administrative users to elevate their privileges to the SYSTEM level, granting them extensive control over the system.
- Code Execution: By modifying Velociraptor's files, attackers can execute arbitrary code with elevated privileges, potentially compromising the entire system.
- Binary Replacement: The vulnerability allows attackers to replace the Velociraptor binary, potentially disabling security measures or installing malicious software.
Mitigation Strategies
- Update Velociraptor: Install the latest version (0.73.3 or later) of Rapid7 Velociraptor MSI Installer to address the vulnerability.
- Restrict User Permissions: Implement access controls to prevent non-administrative users from modifying Velociraptor's files.
- Monitor System Activity: Regularly monitor system logs and activity for any suspicious behavior or unauthorized changes to Velociraptor's files.
- Use Antivirus Software: Employ robust antivirus software to detect and block malicious code that may exploit this vulnerability.
Additional Information
- Threat Actors/APT Groups: No specific threat actors or APT groups have been identified as actively exploiting this vulnerability.
- Exploit Status: Active exploits have not been published.
- CISA Warnings: The Cybersecurity and Infrastructure Security Agency (CISA) has not issued a warning for this vulnerability.
- In the Wild: The vulnerability is not known to be actively exploited in the wild.
If users have additional queries regarding this incident, they can use the 'Ask to Analyst' feature, contact SOCRadar directly, or open a support ticket for more information if necessary.
Indicators of Compromise
Exploits
News
Social Media
Affected Software
References
CWE Details
CVE Radar
Real-time CVE Intelligence & Vulnerability Management Platform
CVE Radar provides comprehensive vulnerability intelligence by monitoring CVE databases, security advisories, and threat feeds. Get instant updates on new vulnerabilities, exploit details, and mitigation strategies specific to your assets.