PT-2021-21171 · Rapid7 · Rapid7 Velociraptor

Mike Cohen + 1 · Published 2021-07-22 · Updated 2021-08-17 · CVE-2021-3619

Positive Technologies (AI Summary)

CVSS v3.1

4.8

Medium

Base vector

AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Rapid7 Velociraptor versions 0.5.9 and prior

Description The issue is a post-authentication persistent cross-site scripting (XSS) problem. An authenticated user could exploit MIME filetype sniffing to embed executable code on a malicious upload. This issue was fixed in version 0.6.0. Typically, login rights to the affected software are reserved for trusted and verified users with IT security backgrounds.

Recommendations For versions 0.5.9 and prior, update to version 0.6.0 or later to resolve the issue. As a temporary workaround, consider restricting file uploads or disabling the functionality that allows embedding executable code until a patch is applied. Restrict access to the affected software to minimize the risk of exploitation, given that login rights are usually reserved for trusted users.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2021-3619

Affected Products

Rapid7 Velociraptor

References · 4

• https://github.com/Velocidex/velociraptor/pull/1118 · Patch
• https://osv.dev/vulnerability/CVE-2021-3619 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-3619 · Security Note
• https://github.com/Velocidex/velociraptor/releases/tag/v0.6.0 · Note