Chris Au

A local buffer overflow exists in the way URLs are handled. An attacker can overwrite structured exception handling (SEH) pointers—a mechanism used to handle software errors—by providing an excessively long URL string. By crafting a malicious URL and pasting it into the Open URL dialog, an attacker can trigger SEH-based code execution to run arbitrary commands with user privileges.

Name of the Vulnerable Software and Affected Versions Rapid7 Velociraptor versions prior to 0.76.2 Description Rapid7 Velociraptor versions before 0.76.2 have an input validation issue in the client monitoring message handler on the Velociraptor server (primarily Linux). An authenticated remote attacker can write to arbitrary internal server queues by sending a crafted monitoring message with a malicious queue name. The server handler does not properly validate the queue name provided by the client, allowing a malicious client to write messages to privileged internal queues. This could lead to remote code execution on the Velociraptor server. Rapid7 Hosted Velociraptor instances are not affected. Recommendations Update to version 0.76.2 or later.

A local buffer overflow exists in the activation code input field. A local attacker can execute arbitrary code by providing a malicious activation code string. This is achieved by crafting a buffer with 608 bytes of junk data, followed by shellcode and SEH (Structured Exception Handling) chain overwrite values, which triggers code execution during the processing of the input in the activation dialog.

A local buffer overflow exists in the Stream Name field. This allows local attackers to execute arbitrary code by triggering a structured exception handler (SEH) overflow—a condition where the program's error-handling mechanism is overwritten to redirect execution flow. An attacker can achieve this by creating a malicious text file containing shellcode and aligned SEH chain pointers and pasting the content into the Stream Name dialog.

The issue is related to improper link resolution before file access, also known as 'Link Following'. This could allow a malicious user to perform a symlink attack, potentially causing a Denial-of-service (DoS) condition on the PC.

An improper link resolution before file access issue exists in the Palo Alto Networks Cortex XDR agent on Windows platforms, enabling a local user to delete arbitrary system files, impact system integrity, or cause a denial of service condition.

A local privilege escalation issue exists in Palo Alto Networks Cortex XDR Agent on the Windows platform, allowing an authenticated local Windows user to execute programs with SYSTEM privileges. This requires the user to have the privilege to create files in the Windows root directory.