Hamad Alghamdi

**Name of the Vulnerable Software and Affected Versions** Velociraptor (affected versions not specified) **Description** Missing authorization checks in the `upload azure`, `upload sftp`, and `upload smb` VQL plugins allow an authenticated user with the analyst role to initiate outbound network connections from the server. This bypasses the NETWORK ACL permission boundary, enabling internal network reconnaissance through a port oracle—a technique used to determine if a port is open based on the server's response—and potential data exfiltration to external endpoints. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Velociraptor (affected versions not specified) **Description** Velociraptor supports multi-tenant deployments called Orgs, consisting of a ROOT org and optional child orgs. The server incorrectly validates the `ORG ADMIN` permission when deleting Orgs, checking the permission within the caller's current ORG rather than the ROOT org. Because administrators of child orgs can add the `ORG ADMIN` permission to their own ACL token, a child org administrator without ROOT org privileges can delete other orgs. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** The product name cannot be determined (affected versions not specified) **Description** The NewNotebook API fails to properly sanitize parameters, enabling an authenticated user with `NOTEBOOK EDIT` permissions to write notebook records outside the organization's data store directory. While the written file must use the `.json.db` extension, this flaw allows the overwriting of other metadata files, including ACL records and hunts, which can lead to significant data corruption. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.