PT-2023-18387 · Unknown · Velociraptor

B1Tg · Published 2023-04-21 · Updated 2023-05-03 · CVE-2023-2226

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Name of the Vulnerable Software and Affected Versions Velociraptor versions prior to 0.6.8

Description The issue is caused by insufficient validation in the PE and OLE parsers, allowing an attacker to crash Velociraptor during parsing of maliciously malformed files. For this attack to succeed, the attacker needs to introduce malicious files to the system while Velociraptor attempts to collect artifacts that parse PE files, Authenticode signatures, or OLE files. After crashing, the Velociraptor service will restart, and it will still be possible to collect other artifacts.

Recommendations For versions prior to 0.6.8, update to version 0.6.8 or later to resolve the issue. As a temporary workaround, consider restricting access to the system to prevent the introduction of malicious files while Velociraptor is collecting artifacts.

Fix

Out of bounds Read

Weakness Enumeration

CWE-125

Related Identifiers

CVE-2023-2226

Affected Products

Velociraptor

References · 4

• https://osv.dev/vulnerability/CVE-2023-2226 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-2226 · Security Note
• https://github.com/Velocidex/velociraptor · Note
• https://t.me/cibsecurity/62597 · Telegram Post