Lucene search

Rapid7CVELIST:CVE-2023-2226

HistoryApr 21, 2023 - 11:48 a.m.

CVE-2023-2226 Velociraptor crashes while parsing some malformed PE or OLE files.

2023-04-2111:48:46

CWE-125

rapid7

www.cve.org

cve-2023-2226

velociraptor

pe files

ole files

validation

rapid7

attacker

artifacts

CVSS3

3.3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

LOW

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L

AI Score

5.5

Confidence

High

EPSS

0.001

Percentile

21.1%

JSON

Due to insufficient validation in the PE and OLE parsers in Rapid7’s Velociraptor versions earlier than 0.6.8 allows attacker to crash Velociraptor during parsing of maliciously malformed files.

For this attack to succeed, the attacker needs to be able to introduce malicious files to the system at the same time that Velociraptor attempts to collect any artifacts that attempt to parse PE files, Authenticode signatures, or OLE files. After crashing, the Velociraptor service will restart and it will still be possible to collect other artifacts.

CNA Affected

[
  {
    "collectionURL": "https://github.com/Velocidex/velociraptor/releases",
    "defaultStatus": "unaffected",
    "modules": [
      "PE Parser",
      "OLE parser",
      "Authenticode parser"
    ],
    "packageName": "Velociraptor",
    "platforms": [
      "Windows"
    ],
    "product": "Velociraptor",
    "repo": "https://github.com/Velocidex/velociraptor/",
    "vendor": "Rapid7",
    "versions": [
      {
        "lessThan": "0.6.8",
        "status": "affected",
        "version": "0",
        "versionType": "semver"
      }
    ]
  }
]

References

github.com/Velocidex/velociraptor

CVSS3

3.3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

LOW

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L

AI Score

5.5

Confidence

High

EPSS

0.001

Percentile

21.1%

JSON

Related for CVELIST:CVE-2023-2226