Skip to content

Commit 67b24d0

Browse files
scudettescudette
authored
Document permissions for each plugin (#573)
Also added CVE-2023-2226
1 parent cbc0d44 commit 67b24d0

File tree

132 files changed

+511
-0
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

132 files changed

+511
-0
lines changed

‎content/announcements/2023-cves/CVE-2023-2226.html

+83
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,83 @@
1+
<p><span>Published by <b>rapid7</b></span> Published 2023-04-21
2+
(updated 2023-04-21)</p>
3+
<details class="popup">
4+
<summary class="lbl rnd sec CVSS LOW">CVSS · LOW ·
5+
3.3<sub>⁄10</sub> <span style="font-size:0px;opacity:0">·
6+
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L</span></summary>
7+
<div class="pop wht rnd shd pad bor"><span>Scoring scenario:</span>
8+
GENERAL
9+
<div>attackVector: <b>LOCAL</b></div>
10+
<div>attackComplexity: <b>LOW</b></div>
11+
<div>privilegesRequired: <b>NONE</b></div>
12+
<div>userInteraction: <b>REQUIRED</b></div>
13+
<div>scope: <b>UNCHANGED</b></div>
14+
<div>confidentialityImpact: <b>NONE</b></div>
15+
<div>integrityImpact: <b>NONE</b></div>
16+
<div>availabilityImpact: <b>LOW</b></div>
17+
<div><a class="vgi-dial" href=
18+
"https://cvss.js.org/#CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L"
19+
target="_blank">Open CVSS Calc</a></div>
20+
</div>
21+
</details>
22+
<div id="description">
23+
<p>Due to insufficient validation in the PE and OLE parsers in
24+
Rapid7's Velociraptor versions earlier than 0.6.8 allows attacker
25+
to crash Velociraptor during parsing of maliciously malformed
26+
files.&nbsp;<br>
27+
<br>
28+
For this attack to succeed, the attacker needs to be able to
29+
introduce malicious files to the system at the same time that
30+
Velociraptor attempts to collect any artifacts that attempt to
31+
parse PE files, Authenticode signatures, or OLE files. After
32+
crashing, the Velociraptor service will restart and it will still
33+
be possible to collect other artifacts.<br>
34+
<br></p>
35+
</div>
36+
<div id="problem">
37+
<h4 class="vgi-bug">Problem:</h4>
38+
<p>CWE-125 Out-of-bounds Read <a href=
39+
"https://cwe.mitre.org/data/definitions/CWE-125" target=
40+
"_blank"><small>CWE-125</small></a><br></p>
41+
</div>
42+
<div id="impact">
43+
<h4 class="vgi-impact">Impact:</h4>
44+
<p>CAPEC-540 Overread Buffers <a href=
45+
"https://capec.mitre.org/data/definitions/CAPEC-540" target=
46+
"_blank"><small>CAPEC-540</small></a><br></p>
47+
</div>
48+
<div id="status">
49+
<h4>Affected Product Status:</h4>
50+
<table class="tbl gap">
51+
<colgroup>
52+
<col>
53+
<col class="affectedCol"></colgroup>
54+
<thead>
55+
<tr>
56+
<th>Product</th>
57+
<th>Affected</th>
58+
</tr>
59+
</thead>
60+
<tbody>
61+
<tr>
62+
<td rowspan="1"><b class="vgi-package">Rapid7 Velociraptor</b>
63+
<span>» PE Parser, OLE parser, Authenticode parser</span> <i>on</i>
64+
<span class="vgi-stack">Windows</span><br>
65+
<a class="vgi-package" href=
66+
"https://github.com/Velocidex/velociraptor/releases">package
67+
repo</a><a class="vgi-ext" href=
68+
"https://github.com/Velocidex/velociraptor/">source repo</a><br>
69+
<span class="vgi-impact">Default status is unaffected</span></td>
70+
<td>before 0.6.8<br></td>
71+
</tr>
72+
</tbody>
73+
</table>
74+
<br style="font-size:0;"></div>
75+
<div id="solution">
76+
<h4 class="vgi-safe">Solution:</h4>
77+
<p>Upgrade the clients to version 0.6.8-2</p>
78+
</div>
79+
<div class="rnd pad sec vgap" id="credits">
80+
<h4 class="vgi-like">Credits:</h4>
81+
<p>Thanks to b1tg https://github.com/b1tg for reporting these
82+
issues and providing samples that trigger the crashes</p>
83+
</div>

‎content/announcements/2023-cves/_index.md

+3
Original file line numberDiff line numberDiff line change
@@ -18,6 +18,9 @@ If you use multiple roles with your Velociraptor GUI users, we
1818
recommend to upgrade your server to the 0.6.7-5 release. These issues
1919
do not affect clients so there is no need to upgrade clients.
2020

21+
## CVE-2023-2226 Velociraptor crashes while parsing some malformed PE or OLE files.
22+
{{< include-html "CVE-2023-2226.html" >}}
23+
2124
## CVE-2023-0242 Insufficient Permission Check In The VQL Copy() Function
2225
{{< include-html "CVE-2023-0242.html" >}}
2326

‎content/vql_reference/basic/copy/_index.md

+4
Original file line numberDiff line numberDiff line change
@@ -25,6 +25,10 @@ dest|The destination file to write.|string (required)
2525
permissions|Required permissions (e.g. 'x').|string
2626
append|If true we append to the target file otherwise truncate it|bool
2727

28+
Required Permissions:
29+
<i class="linkcolour label pull-right label-success">FILESYSTEM_WRITE</i>
30+
<i class="linkcolour label pull-right label-success">FILESYSTEM_READ</i>
31+
2832
### Description
2933

3034
Copy a file.

‎content/vql_reference/basic/environ/_index.md

+3
Original file line numberDiff line numberDiff line change
@@ -21,6 +21,9 @@ Arg | Description | Type
2121
----|-------------|-----
2222
var|Extract the var from the environment.|string (required)
2323

24+
Required Permissions:
25+
<i class="linkcolour label pull-right label-success">MACHINE_STATE</i>
26+
2427
### Description
2528

2629
Get an environment variable.

‎content/vql_reference/basic/expand/_index.md

+3
Original file line numberDiff line numberDiff line change
@@ -21,6 +21,9 @@ Arg | Description | Type
2121
----|-------------|-----
2222
path|A path with environment escapes|string (required)
2323

24+
Required Permissions:
25+
<i class="linkcolour label pull-right label-success">MACHINE_STATE</i>
26+
2427
### Description
2528

2629
Expand the path using the environment.

‎content/vql_reference/basic/getpid/_index.md

+3
Original file line numberDiff line numberDiff line change
@@ -14,6 +14,9 @@ no_edit: true
1414
<span class='vql_type pull-right page-header'>Function</span>
1515

1616

17+
Required Permissions:
18+
<i class="linkcolour label pull-right label-success">MACHINE_STATE</i>
19+
1720
### Description
1821

1922
Returns the current pid of the Velociraptor process.

‎content/vql_reference/basic/killkillkill/_index.md

+3
Original file line numberDiff line numberDiff line change
@@ -21,6 +21,9 @@ Arg | Description | Type
2121
----|-------------|-----
2222
client_id||string (required)
2323

24+
Required Permissions:
25+
<i class="linkcolour label pull-right label-success">MACHINE_STATE</i>
26+
2427
### Description
2528

2629
Kills the client and forces a restart - this is very aggressive!

‎content/vql_reference/basic/read_file/_index.md

+3
Original file line numberDiff line numberDiff line change
@@ -24,6 +24,9 @@ offset|Where to read from the file.|int64
2424
filename|One or more files to open.|OSPath (required)
2525
accessor|An accessor to use.|string
2626

27+
Required Permissions:
28+
<i class="linkcolour label pull-right label-success">FILESYSTEM_READ</i>
29+
2730
### Description
2831

2932
Read a file into a string.

‎content/vql_reference/basic/tempdir/_index.md

+3
Original file line numberDiff line numberDiff line change
@@ -21,6 +21,9 @@ Arg | Description | Type
2121
----|-------------|-----
2222
remove_last|If set we delay removal as much as possible.|bool
2323

24+
Required Permissions:
25+
<i class="linkcolour label pull-right label-success">FILESYSTEM_WRITE</i>
26+
2427
### Description
2528

2629
Create a temporary directory. The directory will be removed when the query ends.

‎content/vql_reference/basic/unzip/_index.md

+4
Original file line numberDiff line numberDiff line change
@@ -24,6 +24,10 @@ accessor|The accessor to use|string
2424
filename_filter|Only extract members matching this filter.|string
2525
output_directory|Where to unzip to|string (required)
2626

27+
Required Permissions:
28+
<i class="linkcolour label pull-right label-success">FILESYSTEM_WRITE</i>
29+
<i class="linkcolour label pull-right label-success">FILESYSTEM_READ</i>
30+
2731
### Description
2832

2933
Unzips a file into a directory

‎content/vql_reference/basic/upload_sftp/_index.md

+3
Original file line numberDiff line numberDiff line change
@@ -28,6 +28,9 @@ privatekey|The private key to use|string (required)
2828
endpoint|The Endpoint to use including port number (e.g. 192.168.1.1:22 )|string (required)
2929
hostkey|Host key to verify. Blank to disable|string
3030

31+
Required Permissions:
32+
<i class="linkcolour label pull-right label-success">FILESYSTEM_READ</i>
33+
3134
### Description
3235

3336
Upload files to SFTP.

‎content/vql_reference/basic/upload_webdav/_index.md

+3
Original file line numberDiff line numberDiff line change
@@ -28,6 +28,9 @@ basic_auth_password|The password to use in HTTP basic auth|string
2828
noverifycert|Skip TLS Verification (deprecated in favor of SkipVerify)|bool
2929
skip_verify|Skip TLS Verification|bool
3030

31+
Required Permissions:
32+
<i class="linkcolour label pull-right label-success">FILESYSTEM_READ</i>
33+
3134
### Description
3235

3336
Upload files to a WebDAV server.

‎content/vql_reference/event/send_event/_index.md

+4
Original file line numberDiff line numberDiff line change
@@ -22,6 +22,10 @@ Arg | Description | Type
2222
artifact|The artifact name to send the event to.|string (required)
2323
row|The row to send to the artifact|ordereddict.Dict (required)
2424

25+
Required Permissions:
26+
<i class="linkcolour label pull-right label-success">SERVER_ADMIN</i>
27+
<i class="linkcolour label pull-right label-success">PUBLISH</i>
28+
2529
### Description
2630

2731
Sends an event to a server event monitoring queue.

‎content/vql_reference/event/watch_csv/_index.md

+3
Original file line numberDiff line numberDiff line change
@@ -26,6 +26,9 @@ separator|Comma separator (default ',')|string
2626
comment|The single character that should be considered a comment|string
2727
columns|The columns to use|list of string
2828

29+
Required Permissions:
30+
<i class="linkcolour label pull-right label-success">FILESYSTEM_READ</i>
31+
2932
### Description
3033

3134
Watch a CSV file and stream events from it. Note: This is an event

‎content/vql_reference/event/watch_evtx/_index.md

+3
Original file line numberDiff line numberDiff line change
@@ -23,6 +23,9 @@ filename|A list of event log files to parse.|list of OSPath (required)
2323
accessor|The accessor to use.|string
2424
messagedb|A Message database from https://github.com/Velocidex/evtx-data.|string
2525

26+
Required Permissions:
27+
<i class="linkcolour label pull-right label-success">FILESYSTEM_READ</i>
28+
2629
### Description
2730

2831
Watch an EVTX file and stream events from it.

‎content/vql_reference/event/watch_monitoring/_index.md

+3
Original file line numberDiff line numberDiff line change
@@ -21,6 +21,9 @@ Arg | Description | Type
2121
----|-------------|-----
2222
artifact|The artifact to watch|string
2323

24+
Required Permissions:
25+
<i class="linkcolour label pull-right label-success">READ_RESULTS</i>
26+
2427
### Description
2528

2629
Watch clients' monitoring log. This is an event plugin. This

‎content/vql_reference/event/watch_syslog/_index.md

+3
Original file line numberDiff line numberDiff line change
@@ -23,6 +23,9 @@ filename|A list of log files to parse.|list of OSPath (required)
2323
accessor|The accessor to use.|string
2424
buffer_size|Maximum size of line buffer.|int
2525

26+
Required Permissions:
27+
<i class="linkcolour label pull-right label-success">FILESYSTEM_READ</i>
28+
2629
### Description
2730

2831
Watch a syslog file and stream events from it.

‎content/vql_reference/linux/audit/_index.md

+3
Original file line numberDiff line numberDiff line change
@@ -14,6 +14,9 @@ no_edit: true
1414
<span class='vql_type pull-right page-header'>Plugin</span>
1515

1616

17+
Required Permissions:
18+
<i class="linkcolour label pull-right label-success">MACHINE_STATE</i>
19+
1720
### Description
1821

1922
Register as an audit daemon in the kernel.

‎content/vql_reference/misc/client_create/_index.md

+3
Original file line numberDiff line numberDiff line change
@@ -26,6 +26,9 @@ os|What type of OS this is (default offline)|string
2626
hostname|The hostname of the system|string
2727
client_id|if set we use this client id otherwise we make a new one|string
2828

29+
Required Permissions:
30+
<i class="linkcolour label pull-right label-success">SERVER_ADMIN</i>
31+
2932
### Description
3033

3134
Create a new client in the data store.

‎content/vql_reference/misc/create_notebook_download/_index.md

+3
Original file line numberDiff line numberDiff line change
@@ -21,6 +21,9 @@ Arg | Description | Type
2121
----|-------------|-----
2222
notebook_id|Client ID to export.|string (required)
2323

24+
Required Permissions:
25+
<i class="linkcolour label pull-right label-success">PREPARE_RESULTS</i>
26+
2427
### Description
2528

2629
Creates a notebook export zip file.

‎content/vql_reference/misc/delete_events/_index.md

+3
Original file line numberDiff line numberDiff line change
@@ -25,6 +25,9 @@ start_time|Start time to be deleted|time.Time
2525
end_time|End time to be deleted|time.Time
2626
really_do_it|If not specified, just show what files will be removed|bool
2727

28+
Required Permissions:
29+
<i class="linkcolour label pull-right label-success">SERVER_ADMIN</i>
30+
2831
### Description
2932

3033
Delete all the files that make up a flow.

‎content/vql_reference/misc/delete_flow/_index.md

+3
Original file line numberDiff line numberDiff line change
@@ -22,6 +22,9 @@ Arg | Description | Type
2222
client_id||string (required)
2323
flow_id||string
2424

25+
Required Permissions:
26+
<i class="linkcolour label pull-right label-success">SERVER_ADMIN</i>
27+
2528
### Description
2629

2730
Delete all the files that make up a flow.

‎content/vql_reference/misc/efivariables/_index.md

+3
Original file line numberDiff line numberDiff line change
@@ -23,6 +23,9 @@ namespace|Variable namespace.|string
2323
name|Variable name|string
2424
value|Read variable value|bool
2525

26+
Required Permissions:
27+
<i class="linkcolour label pull-right label-success">MACHINE_STATE</i>
28+
2629
### Description
2730

2831
Enumerate efi variables.

‎content/vql_reference/misc/flow_logs/_index.md

+3
Original file line numberDiff line numberDiff line change
@@ -22,6 +22,9 @@ Arg | Description | Type
2222
flow_id|The flow id to read.|string (required)
2323
client_id|The client id to extract|string (required)
2424

25+
Required Permissions:
26+
<i class="linkcolour label pull-right label-success">READ_RESULTS</i>
27+
2528
### Description
2629

2730
Retrieve the query logs of a flow.

‎content/vql_reference/misc/get_flow/_index.md

+4
Original file line numberDiff line numberDiff line change
@@ -22,6 +22,10 @@ Arg | Description | Type
2222
client_id||string (required)
2323
flow_id||string
2424

25+
Required Permissions:
26+
<i class="linkcolour label pull-right label-success">COLLECT_CLIENT</i>
27+
<i class="linkcolour label pull-right label-success">COLLECT_SERVER</i>
28+
2529
### Description
2630

2731
Gets flow details.

‎content/vql_reference/misc/hunt_delete/_index.md

+3
Original file line numberDiff line numberDiff line change
@@ -22,6 +22,9 @@ Arg | Description | Type
2222
hunt_id||string (required)
2323
really_do_it||bool
2424

25+
Required Permissions:
26+
<i class="linkcolour label pull-right label-success">SERVER_ADMIN</i>
27+
2528
### Description
2629

2730
Delete a hunt.

‎content/vql_reference/misc/hunt_update/_index.md

+3
Original file line numberDiff line numberDiff line change
@@ -24,6 +24,9 @@ stop|Stop the hunt|bool
2424
start|Start the hunt|bool
2525
description|Update hunt description|string
2626

27+
Required Permissions:
28+
<i class="linkcolour label pull-right label-success">START_HUNT</i>
29+
2730
### Description
2831

2932
Update a hunt.

‎content/vql_reference/misc/mail/_index.md

+3
Original file line numberDiff line numberDiff line change
@@ -32,6 +32,9 @@ auth_password|The SMTP username password we use to authenticate to the server.|s
3232
skip_verify|Skip SSL verification(default: False).|bool
3333
root_ca|As a better alternative to disable_ssl_security, allows root ca certs to be added here.|string
3434

35+
Required Permissions:
36+
<i class="linkcolour label pull-right label-success">SERVER_ADMIN</i>
37+
3538
### Description
3639

3740
Send Email to a remote server.

‎content/vql_reference/misc/monitoring_logs/_index.md

+3
Original file line numberDiff line numberDiff line change
@@ -25,6 +25,9 @@ source|An optional named source within the artifact|string
2525
start_time|Start return events from this date (for event sources)|Any
2626
end_time|Stop end events reach this time (event sources).|Any
2727

28+
Required Permissions:
29+
<i class="linkcolour label pull-right label-success">READ_RESULTS</i>
30+
2831
### Description
2932

3033
Retrieve log messages from client event monitoring for the specified client id and artifact

‎content/vql_reference/misc/org_create/_index.md

+3
Original file line numberDiff line numberDiff line change
@@ -22,6 +22,9 @@ Arg | Description | Type
2222
name|The name of the org.|string (required)
2323
org_id|An ID for the new org (if not set use a random ID).|string
2424

25+
Required Permissions:
26+
<i class="linkcolour label pull-right label-success">ORG_ADMIN</i>
27+
2528
### Description
2629

2730
Creates a new organization.

‎content/vql_reference/misc/org_delete/_index.md

+3
Original file line numberDiff line numberDiff line change
@@ -21,6 +21,9 @@ Arg | Description | Type
2121
----|-------------|-----
2222
org|The org ID to delete.|string (required)
2323

24+
Required Permissions:
25+
<i class="linkcolour label pull-right label-success">ORG_ADMIN</i>
26+
2427
### Description
2528

2629
Deletes an Org from the server.

‎content/vql_reference/misc/pe_dump/_index.md

+3
Original file line numberDiff line numberDiff line change
@@ -23,6 +23,9 @@ pid|The pid to dump.|uint64 (required)
2323
base_offset|The offset in the file for the base address.|int64 (required)
2424
in_memory|By default we store to a tempfile and return the path. If this option is larger than 0, we prepare the file in a memory buffer at the specified limit, to avoid AV alerts on disk access.|uint64
2525

26+
Required Permissions:
27+
<i class="linkcolour label pull-right label-success">MACHINE_STATE</i>
28+
2629
### Description
2730

2831
Dump a PE file from process memory.

0 commit comments

Comments
 (0)