Itay Vardi

**Name of the Vulnerable Software and Affected Versions** Velociraptor versions prior to 0.77.2 **Description** The VQL `query()` plugin allows executing a VQL query within a different organization or user context. To perform this action, the calling user must possess the `IMPERSONATE` permission. The issue arises because the software evaluates this permission against the caller's organization rather than the target organization. Consequently, an administrator from one organization can impersonate a user in another organization, even if they lack the `IMPERSONATE` permission within that target organization. **Recommendations** Update to version 0.77.2 or later.

**Name of the Vulnerable Software and Affected Versions** Velociraptor (affected versions not specified) **Description** The gRPC API contains a flaw in the 'VFSGetBuffer' endpoint used for reading files from the datastore. The system employs a prefix check against a list of denied prefixes to prevent unauthorized access to sensitive files or other organizations. This check can be bypassed, enabling users to access restricted files. Specifically, a user with read permissions in the ROOT organization can gain unauthorized access to other organizations. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.