CVE-2025-6264
📋 TL;DR
This vulnerability in Velociraptor allows users with COLLECT_CLIENT permissions (typically Investigator role) to execute the Admin.Client.UpdateClientConfig artifact without proper authorization checks. This enables arbitrary command execution and endpoint takeover on affected systems. Organizations using Velociraptor for endpoint monitoring and incident response are affected.
💻 Affected Systems
- Velociraptor
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete compromise of all endpoints managed by Velociraptor, allowing attackers to execute arbitrary commands, install malware, exfiltrate data, and maintain persistent access.
Likely Case
Privileged users with Investigator role could unintentionally or maliciously modify client configurations to execute unauthorized commands, potentially leading to data breaches or system disruption.
If Mitigated
With proper role-based access controls and monitoring, impact is limited to authorized users who would need to bypass additional security layers.
🎯 Exploit Status
Exploitation requires authenticated access with COLLECT_CLIENT permissions. The vulnerability is simple to exploit once the attacker has appropriate credentials.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Latest version with fix (check Velociraptor releases)
Vendor Advisory: https://docs.velociraptor.app/announcements/advisories/cve-2025-6264/
Restart Required: Yes
Instructions:
1. Update Velociraptor to the latest patched version. 2. Restart Velociraptor services. 3. Verify the Admin.Client.UpdateClientConfig artifact now requires EXECVE permission.
🔧 Temporary Workarounds
Remove COLLECT_CLIENT from Investigator role
allTemporarily remove COLLECT_CLIENT permission from Investigator role users until patching is complete.
# Modify role configuration to remove COLLECT_CLIENT permission from Investigator role
Restrict access to Admin.Client.UpdateClientConfig
allManually configure the artifact to require EXECVE permission.
# Edit artifact definition to add required_permissions: [EXECVE]
🧯 If You Can't Patch
- Implement strict role-based access control and limit Investigator role assignments
- Enable detailed logging and monitoring of artifact collection activities
🔍 How to Verify
Check if Vulnerable:
Check if users with Investigator role (COLLECT_CLIENT permission) can collect Admin.Client.UpdateClientConfig artifact without EXECVE permission.Check Version:
velociraptor --versionVerify Fix Applied:
Verify that Admin.Client.UpdateClientConfig artifact now requires EXECVE permission and users with only COLLECT_CLIENT cannot execute it.📡 Detection & Monitoring
Log Indicators:
- Unauthorized collection of Admin.Client.UpdateClientConfig artifact
- Configuration changes from non-administrative users
- Artifact execution without proper permissions
Network Indicators:
- Unusual artifact collection patterns
- Configuration update requests from non-admin users
SIEM Query:
source="velociraptor" AND (artifact="Admin.Client.UpdateClientConfig" AND user_role="Investigator")