Rapid7 Velociraptor up to 0.74.2 VQL Query Admin.Client.UpdateClientConfig default permission

Summaryinfo

A vulnerability was found in Rapid7 Velociraptor up to 0.74.2 and classified as critical. Affected by this issue is the function Admin.Client.UpdateClientConfig of the component VQL Query Handler. The manipulation results in default permission. This vulnerability is known as CVE-2025-6264. Attacking locally is a requirement. Furthermore, an exploit is available. It is suggested to upgrade the affected component.

Detailsinfo

A vulnerability classified as problematic has been found in Rapid7 Velociraptor up to 0.74.2. Affected is the function Admin.Client.UpdateClientConfig of the component VQL Query Handler. The manipulation with an unknown input leads to a default permission vulnerability. CWE is classifying the issue as CWE-276. During installation, installed file permissions are set to allow anyone to modify those files. This is going to have an impact on confidentiality, integrity, and availability. CVE summarizes:

Velociraptor allows collection of VQL queries packaged into Artifacts from endpoints. These artifacts can be used to do anything and usually run with elevated permissions.  To limit access to some dangerous artifact, Velociraptor allows for those to require high permissions like EXECVE to launch. The Admin.Client.UpdateClientConfig is an artifact used to update the client's configuration. This artifact did not enforce an additional required permission, allowing users with COLLECT_CLIENT permissions (normally given by the "Investigator" role) to collect it from endpoints and update the configuration. This can lead to arbitrary command execution and endpoint takeover. To successfully exploit this vulnerability the user must already have access to collect artifacts from the endpoint (i.e. have the COLLECT_CLIENT given typically by the "Investigator' role).

The advisory is shared for download at docs.velociraptor.app. This vulnerability is traded as CVE-2025-6264 since 06/19/2025. The exploitability is told to be difficult. The attack needs to be approached locally. The exploitation requires an enhanced level of successful authentication. Technical details and a exploit are known. The MITRE ATT&CK project declares the attack technique as T1222.

It is declared as attacked. The vulnerability scanner Nessus provides a plugin with the ID 279071 (Rapid7 Velociraptor < 0.74.3 Privilege Escalation), which helps to determine the existence of the flaw in a target environment.

Upgrading to version 0.74.3 eliminates this vulnerability.

The vulnerability is also documented in the databases at Tenable (279071) and EUVD (EUVD-2025-18787). Once again VulDB remains the best source for vulnerability data.

Productinfo

Vendor

• Rapid7

Name

• Velociraptor

Version

• 0.74.0
• 0.74.1
• 0.74.2

License

• commercial

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion