Leon Kayaliev

Bandisoft Bandizip before 7.47 fails to propagate Mark-of-the-Web to extracted .ps1 and .psm1 files, allowing attackers to bypass zone-based execution protections. Attackers can deliver unsigned PowerShell scripts or modules in downloaded archives that run under the RemoteSigned policy when the user invokes them.

**Name of the Vulnerable Software and Affected Versions** Velociraptor (affected versions not specified) **Description** The `SetClientMetadata()` function uses an incorrect permission check when enforcing the setting of metadata on the server. This flaw allows a user possessing the `LABEL CLIENTS` permission to modify server metadata, which is typically used to store site-wide configuration data intended to be managed exclusively by the server administrator. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Velociraptor (affected versions not specified) **Description** The WatchEvent gRPC API allows the specification of an `OrgId` to determine which organization's events should be streamed. The server incorrectly validates API permissions against the caller's organization rather than the requested organization. This flaw enables a user with API access in one organization to read events from another organization without authorization. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Velociraptor (affected versions not specified) **Description** Velociraptor uses Artifacts to package VQL queries for collection from endpoints, which typically execute with elevated permissions. To restrict dangerous operations, certain artifacts require high-level permissions such as EXECVE. The `Windows.Sysinternals.SysmonLogForward` monitoring artifact, designed to forward sysmon events to the server, allows users to specify an arbitrary binary path as a parameter. Because it fails to enforce the necessary additional permissions, users with `COLLECT CLIENT` permissions (typically assigned to the Investigator role) can execute an arbitrary binary program on the endpoint instead of the intended sysmon binary. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Velociraptor (affected versions not specified) **Description** Velociraptor stores compiled VQL (Velociraptor Query Language) within the hunt object to prevent redundant recompilation for every endpoint. A flaw exists where the internal field `compiled collector args` can be modified via a user API call. This allows a user with the investigator role to define compiled VQL statements for a hunt, bypassing standard Access Control List (ACL) checks. This issue can be escalated to enable an investigator to execute arbitrary VQL statements with administrator privileges on the server. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Velociraptor (affected versions not specified) **Description** Certain sensitive artifacts are intended to be restricted by additional permissions to prevent unauthorized actions. For instance, the `Linux.Sys.BashShell` artifact allows arbitrary command execution on endpoints and requires the `EXECVE` permission. However, a flaw exists where client monitoring artifacts do not undergo these permission checks, nor is there a requirement for them to carry the `CLIENT EVENTS` type. This allows users with permissions to schedule client monitoring artifacts to bypass restrictions and schedule sensitive artifacts like `Linux.Sys.BashShell`. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Velociraptor (affected versions not specified) **Description** The default daily backup feature allows for the creation of notebook backups. During the restoration process, notebook cell content is interpolated into a template without Access Control List (ACL) checks. This flaw enables a user with `NOTEBOOK EDITOR` permissions to embed a VQL (Velociraptor Query Language) query that executes with elevated privileges upon the restoration of the notebook backup. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**اسم البرنامج المعرض للخطر والإصدارات المتأثرة** يتعذر تحديد اسم المنتج (لم يتم تحديد الإصدارات المتأثرة) **الوصف** يمكن لمهاجم تمت مصادقته انتحال هوية مستخدم آخر لواجهة المستخدم الرسومية (GUI) عن طريق تضمين رأس مخصص `Grpc-Metadata-USER` في طلبه. تتيح هذه الثغرة لمستخدم يتمتع بامتيازات محدودة الاستيلاء على الحساب والحصول على صلاحيات المسؤول. **التوصيات** في الوقت الحالي، لا توجد معلومات حول إصدار أحدث يحتوي على إصلاح لهذه الثغرة الأمنية.