Rapid7 Velociraptor YAML Injection Vulnerability in Remapping Artifact Allowing Arbitrary VQL Execution

A YAML injection vulnerability has been identified in the Windows.Collectors.Remapping artifact of Rapid7 Velociraptor, affecting versions prior to 0.76.6. The vulnerability arises because the hostname field in client_info.json, located within a collection ZIP, is inserted into a YAML template using Go's text/template without proper escaping. An attacker can exploit this by crafting a collection ZIP that includes literal double quotes and newlines in the hostname, breaking out of the YAML quoted string and injecting a new mount remapping entry. When the injected remapping file is applied with the --remap option, it executes arbitrary VQL on the analyst's machine with NullACLManager, granting all permissions without sandboxing.

Impact

Exploitation of this vulnerability allows for arbitrary VQL execution on the analyst's machine, with elevated permissions and no sandboxing, potentially leading to unauthorized actions or access to sensitive information.

Remediation

Users can upgrade to Velociraptor version 0.76.6 or later. Alternatively, the latest Windows.Collectors.Remapping artifact can be copied from the latest release on GitHub into the Velociraptor config file.