CVE-2022-35631

2022-07-2917:15:09

CWE-59

CWE-377

[email protected]

web.nvd.nist.gov

symlink

attack

macos

linux

velociraptor

CVSS3

5.5

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

EPSS

Percentile

12.6%

JSON

On MacOS and Linux, it may be possible to perform a symlink attack by replacing this predictable file name with a symlink to another file and have the Velociraptor client overwrite the other file. This issue was resolved in Velociraptor 0.6.5-2.

Affected configurations

Nvd

Node

rapid7velociraptorRange<0.6.5-2

AND

applemacosMatch-

linuxlinux_kernelMatch-

VendorProductVersionCPE
rapid7velociraptor*cpe:2.3:a:rapid7:velociraptor:*:*:*:*:*:*:*:*
applemacos-cpe:2.3:o:apple:macos:-:*:*:*:*:*:*:*
linuxlinux_kernel-cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
rapid7	velociraptor	*	cpe:2.3:a:rapid7:velociraptor::::::::
apple	macos	-	cpe:2.3:o:apple:macos:-:::::::*
linux	linux_kernel	-	cpe:2.3:o:linux:linux_kernel:-:::::::*