Skip to content

Commit b77a1c0

Browse files
scudettescudette
authored
Add release 0.76.6 (Velocidex#1269)
1 parent e414f32 commit b77a1c0

16 files changed

Lines changed: 521 additions & 61 deletions

File tree

‎Makefile‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -49,3 +49,6 @@ comparisons:
4949

5050
descriptions:
5151
python3 scripts/descriptions.py content/
52+
53+
vale:
54+
vale --output line .

‎content/announcements/advisories/CVE-2026-6863/_index.md‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -59,7 +59,7 @@ no_children: true
5959
</b>
6060
</div>
6161
<div>availabilityImpact:
62-
<b>HIGH
62+
<b>NONE
6363
</b>
6464
</div>
6565
<div>

‎content/announcements/advisories/CVE-2026-8795/_index.md‎

Lines changed: 194 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,194 @@
1+
---
2+
menutitle: "CVE-2026-8795"
3+
title: "CVE-2026-8795 YAML Injection Leading to Potential Analyst Targeting"
4+
description: |
5+
A YAML injection vulnerability in the
6+
Windows.Collectors.Remapping artifact allows an attacker who
7+
supplies a crafted collection ZIP to execute arbitrary VQL on the
8+
analyst's machine.
9+
weight: -10
10+
date: 2026-05-01T00:00:00Z
11+
no_edit: true
12+
noTitle: false
13+
no_children: true
14+
---
15+
16+
<div class="cve">
17+
<p>
18+
<span>Published
19+
</span>on 2026-06-04
20+
</p>
21+
<p>
22+
</p>
23+
<details class="popup">
24+
<summary class="lbl rnd sec CVSS HIGH">CVSS · HIGH · 7.8
25+
<sub>⁄10
26+
</sub>
27+
<span style="font-size:0px;opacity:0"> · CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
28+
</span>
29+
</summary>
30+
<div class="pop wht rnd shd pad bor">
31+
<span>Scoring scenario:
32+
</span>GENERAL
33+
<div>attackVector:
34+
<b>LOCAL
35+
</b>
36+
</div>
37+
<div>attackComplexity:
38+
<b>LOW
39+
</b>
40+
</div>
41+
<div>privilegesRequired:
42+
<b>NONE
43+
</b>
44+
</div>
45+
<div>userInteraction:
46+
<b>REQUIRED
47+
</b>
48+
</div>
49+
<div>scope:
50+
<b>UNCHANGED
51+
</b>
52+
</div>
53+
<div>confidentialityImpact:
54+
<b>HIGH
55+
</b>
56+
</div>
57+
<div>integrityImpact:
58+
<b>HIGH
59+
</b>
60+
</div>
61+
<div>availabilityImpact:
62+
<b>HIGH
63+
</b>
64+
</div>
65+
<div>
66+
<a class="vgi-dial" href="https://www.first.org/cvss/calculator/3.0#CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" target="_blank">Open CVSS Calc
67+
</a>
68+
</div>
69+
</div>
70+
</details>
71+
<p>
72+
</p>
73+
<div id="description">
74+
<p>
75+
A YAML injection vulnerability in the Windows.Collectors.Remapping
76+
artifact allows an attacker who supplies a crafted
77+
collection ZIP to execute arbitrary VQL on the analyst's
78+
machine. The hostname field in client_info.json inside the ZIP is
79+
inserted into a YAML template via Go's text/template without any
80+
YAML escaping. By embedding a literal " followed by newlines in
81+
the hostname, an attacker breaks out of the YAML quoted string and
82+
injects a new mount remapping entry whose scope field contains VQL
83+
that executes with NullACLManager (all permissions granted, no
84+
sandboxing) when the analyst applies the generated remapping file
85+
with --remap.
86+
</p>
87+
</div>
88+
<div id="problem">
89+
<h2>Problem:
90+
</h2>
91+
<p>CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
92+
<a href="https://cwe.mitre.org/data/definitions/74" target="_blank">
93+
<small>CWE-74</small>
94+
</a>
95+
<br>
96+
</p>
97+
<p>CWE-94 Improper Control of Generation of Code ('Code Injection')
98+
<a href="https://cwe.mitre.org/data/definitions/94" target="_blank">
99+
<small>CWE-94</small>
100+
</a>
101+
<br>
102+
</p>
103+
<p>CWE-116 Improper Encoding or Escaping of Output
104+
<a href="https://cwe.mitre.org/data/definitions/116" target="_blank">
105+
<small>CWE-116</small>
106+
</a>
107+
<br>
108+
</p>
109+
110+
</div>
111+
<div id="impact">
112+
<h2>Impact:
113+
</h2>
114+
<p>CAPEC-549: Local Execution of Code
115+
<a href="https://capec.mitre.org/data/definitions/549.html" target="_blank">
116+
<small>CAPEC-549
117+
</small>
118+
</a>
119+
<br>
120+
</p>
121+
</div>
122+
<div id="status">
123+
<h2>Product Status:
124+
</h2>
125+
<table class="striped">
126+
<colgroup>
127+
<col>
128+
<col class="affectedCol">
129+
</colgroup>
130+
<thead>
131+
<tr>
132+
<th>Product
133+
</th>
134+
<th>Affected
135+
</th>
136+
</tr>
137+
</thead>
138+
<tbody>
139+
<tr>
140+
<td rowspan="1">
141+
<b class="vgi-package">Rapid7 Velociraptor
142+
</b>
143+
<i> on
144+
</i>
145+
<span class="vgi-stack">Linux
146+
</span>
147+
<br>
148+
<a class="vgi-ext" href="https://github.com/Velocidex/velociraptor">source repo
149+
</a>
150+
<br>
151+
<span class="vgi-impact">Default status is unaffected
152+
</span>
153+
</td>
154+
<td>
155+
before 0.76.6
156+
</td>
157+
</tr>
158+
</tbody>
159+
</table>
160+
<br style="font-size:0;">
161+
</div>
162+
<div class="rnd pad sec vgap" id="credits">
163+
<h2>Credits:
164+
</h2>
165+
<p>We thank <b>Artificial Intelligence</b> for identifying and reporting this issue responsibly
166+
</p>
167+
</div>
168+
<div id="references">
169+
<h2>References
170+
</h2>
171+
<p>
172+
</p>
173+
<div>
174+
<a href="https://docs.velociraptor.app/announcements/advisories/cve-2026-8795/">docs.velociraptor.app/announcements/advisories/cve-2026-8795/
175+
</a>
176+
</div>
177+
<p>
178+
</p>
179+
</div>
180+
</div>
181+
182+
## Required configuration for exposure
183+
184+
This vulnerability only affects users who use
185+
[remapping](/docs/forensic/deaddisk/creating_running/) to directly
186+
operate on offline collections. This usage typically uses the
187+
`Windows.Collectors.Remapping` artifact to generate a remapping file
188+
and then subsequently uses that remapping file to collect artifacts on
189+
the offline collector file directly. This is a very niche use case and
190+
a very common processing pipeline.
191+
192+
To mitigate this issue you can upgrade the server to version
193+
`0.76.6` or copy the latest [Windows.Collectors.Remapping](https://github.com/Velocidex/velociraptor/blob/master/artifacts/definitions/Windows/Collectors/Remapping.yaml) artifact from the
194+
latest release into the [config file](/docs/deployment/references/#Frontend.artifact_definitions_directory).

‎content/docs/deployment/security/_index.md‎

Lines changed: 42 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -25,6 +25,47 @@ deployment methods to ensure it can be secured on the network. We then
2525
discuss the Velociraptor permission model and suggest some further
2626
steps to ensure user actions are audited and controlled.
2727

28+
## Client verification
29+
30+
From the outset we need to highlight a fundamental limitation of agent
31+
based security software.
32+
33+
> Because the agent (The Velociraptor `Client`) is running on a
34+
> potentially compromised platform, We can never fully trust what the
35+
> client is telling us.
36+
37+
There is no guarantee that the client will work correctly - it may be
38+
subverted by an attacker (who has full control of the endpoint) to:
39+
40+
1. Disable the client completely - it will not report to the server.
41+
2. The client may omit reporting some information - For example, the
42+
client may hide sensitive files or artifacts that the attacker
43+
wants to hide.
44+
3. The client may report incorrect information (for example fake
45+
processes, files etc).
46+
47+
This is a fundamental limitation in the server/client model and can
48+
not be mitigated. Typically the Velociraptor client is running at an
49+
elevated permissions level which makes it harder to interact with by
50+
low privileged users, this reduces the risk somewhat. If you have an
51+
EDR installed on the endpoint, you may add anti-tamper rules to the
52+
EDR to reduce the risk of client interference even further - however
53+
there is always a residual risk of interference when the platform may
54+
be compromised.
55+
56+
We refer to a compromised client as a `Rogue Client`. This type of
57+
client can send malformed responses or fake data.
58+
59+
You should always keep this limitation in mind when interpreting
60+
results from Velociraptor. The results may be missing or incorrect, or
61+
a client may be completely disabled by an attacker.
62+
63+
The main concern for Velociraptor is to ensure that one client can not
64+
impersonate another client. This mitigates the risk of a compromised
65+
client injecting fake information about another client. Velociraptor
66+
mitigates this risk using cryptographic keys as described in the next
67+
section.
68+
2869
## Velociraptor communications
2970

3071
How do Velociraptor clients communicate with the server? You can read
@@ -1179,7 +1220,7 @@ accessing the disk directly to bypass ACLs and denied paths.
11791220
{{% /notice %}}
11801221

11811222

1182-
{{% notice warn "`http_client()`, Unix sockets, and server ACLs" %}}
1223+
{{% notice warning "`http_client()`, Unix sockets, and server ACLs" %}}
11831224

11841225
The VQL `http_client()` plugin understands URLs like
11851226
`/var/run/docker.sock:unix/v1/version`, which relays HTTP traffic

‎content/downloads/_index.md‎

Lines changed: 11 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -5,57 +5,57 @@ draft: false
55
weight: 25
66
no_children: true
77
pre: <i class="fas fa-download"></i>
8-
release: 0.76.5
8+
release: 0.76.6
99
base_release: 0.76
1010
arches:
1111
- desc: Windows AMD64 (64-bit) Executable
1212
name: windows-amd64.exe
13-
hash: 4813e753f6f9bfa5c5de0edbb8dd3cc7f1fa51714097d3144d44e5e89dbd33ef
13+
hash: 1e82175822aa9ffdfd7bc177599642f3db55159d0a2f38bb0fcc6722f15573cd
1414
platform: windows
1515

1616
- desc: Windows AMD64 (64-bit) MSI
1717
name: windows-amd64.msi
18-
hash: a35a220a58360bbe501b5f9cb4ccf4eda188c6e68e770bf0a79bea75d3b2b899
18+
hash: e5fc16e7d4aea87f70edb9ce09112f1c92808b9e4547a544769d433545ff3ee3
1919
platform: windows
2020

2121
- desc: Windows 32-bit Executable
2222
name: windows-386.exe
23-
hash: 402e7968257bb8b3d85864517c452dde04d0c997ddfdbf161908bc377987521b
23+
hash: 4c329cb5b1d881ef7681e4faea9dc8f8e081bb579739d557ca0dc5bc57a8ef12
2424
platform: windows
2525

2626
- desc: Windows 32-bit MSI
2727
name: windows-386.msi
28-
hash: fe407135b9f0e7fa149533b42119814afdb036b3489f26637ba6243841c68aff
28+
hash: 9fb535710bba977f28761b387c3e90095ac02022cb1f3765b7067de9fdda3ce1
2929
platform: windows
3030

3131
- desc: Linux Ubuntu 22.04 AMD64 and later. Recommended for servers.
3232
name: linux-amd64
33-
hash: e6b2b379c90aaddf549a200dea108fe34e397994d45d2fc3b68f53b2f5277b51
33+
hash: 9b1c439834a562a96cbef886f26a93521d16b020fd96777fb30e01f88947af18
3434
platform: linux
3535

3636
- desc: Linux Ubuntu 22.04 ARM and later. Recommended for servers or containers.
3737
name: linux-arm64
38-
hash: 5e38969f199823535f1bd8611e1ab95e45c2cc4a4522d0c2a68474cdbe098214
38+
hash: d19218d37d76b6988d25d21d2cdb349658fa12b355d44c90f44b5cdd975b7616
3939
platform: linux
4040

4141
- desc: Linux Static Build (Older Releases, e.g. RHEL, Centos) Recommended for clients.
4242
name: linux-amd64-musl
43-
hash: e7e43975f4855e03aba0e7d9ef2a8ed32c58112718074ddcf3535bebf90e1f2f
43+
hash: 84ad1652ff6e79694441a06a6af4040aae6a982080d2ef583a31bda52f58e299
4444
platform: linux
4545

4646
- desc: Linux Sumo build. Recommended for servers.
4747
name: linux-amd64-sumo-musl
48-
hash: 8b2d1e8cd74ea58a56ce0ed0c052c2e66ad45980f0b35bab6afe566363cae745
48+
hash: f39269d2c1858497c0f244caefc603c9061ef4d837201aa28c18831967cc6343
4949
platform: linux
5050

5151
- desc: MacOS AMD64
5252
name: darwin-amd64
53-
hash:
53+
hash: 6308ea8c7f7dbacad791977caefe387c61daaebf4f94cde2e1c39d89968091a3
5454
platform: apple
5555

5656
- desc: MacOS ARM (M1, M2 chipsets)
5757
name: darwin-arm64
58-
hash:
58+
hash: 4518998f95de31d4ee5734dfbcdd60f834c43a1b9fc6f9a1f372d8099172a496
5959
platform: apple
6060

6161
- desc: FreeBSD AMD64

0 commit comments

Comments
 (0)