CVE-2025-6264: Velociraptor Privilege Escalation Flaw

CVE-2025-6264 Overview

CVE-2025-6264 affects Rapid7 Velociraptor, an open-source endpoint monitoring and digital forensics platform. The vulnerability resides in the Admin.Client.UpdateClientConfig artifact, which failed to enforce an additional required permission. Users holding only COLLECT_CLIENT privileges, typically granted through the built-in "Investigator" role, can collect this artifact from endpoints and modify the client configuration. Successful exploitation leads to arbitrary command execution and full endpoint takeover. The flaw is categorized under [CWE-276: Incorrect Default Permissions]. Public reporting from Talos and Sophos indicates Velociraptor has been abused in ransomware and remote-access intrusions, elevating operational risk for organizations running vulnerable versions.

Critical Impact
An authenticated user with the "Investigator" role can weaponize the Admin.Client.UpdateClientConfig artifact to execute arbitrary commands on any monitored endpoint, resulting in complete host compromise.

Affected Products

Rapid7 Velociraptor (versions prior to the fixed release)
Deployments granting the built-in "Investigator" role to users
Multi-tenant Velociraptor servers where COLLECT_CLIENT is broadly assigned

Discovery Timeline

2025-06-20 - CVE-2025-6264 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-6264

Vulnerability Analysis

Velociraptor executes Velociraptor Query Language (VQL) queries packaged as Artifacts against connected endpoints. Artifacts frequently run with elevated privileges and can perform sensitive operations, including command execution through the execve() plugin. To mitigate this, Velociraptor allows individual artifacts to require additional permissions such as EXECVE before collection is authorized.

The Admin.Client.UpdateClientConfig artifact updates a client's configuration file on the endpoint. Because a modified client configuration can direct the agent to trust an attacker-controlled server or invoke attacker-supplied binaries, this artifact should have required an elevated permission. The advisory confirms the artifact did not declare that additional permission requirement.

Any user assigned the "Investigator" role, which grants COLLECT_CLIENT, could therefore collect the artifact and push a malicious configuration. Once the client accepts the modified configuration, the attacker gains a reliable command execution primitive on the endpoint.

Root Cause

The root cause is a missing permission declaration on a privileged artifact. The Admin.Client.UpdateClientConfig artifact should have required an administrative permission such as SERVER_ADMIN or EXECVE, but instead relied solely on the baseline COLLECT_CLIENT permission. This mismatch between the artifact's capabilities and its enforced permission boundary constitutes an insecure default configuration [CWE-276].

Attack Vector

An attacker must first authenticate to the Velociraptor server with a role granting COLLECT_CLIENT. From the web console or API, the attacker schedules collection of Admin.Client.UpdateClientConfig against a target endpoint, supplying a crafted configuration. The client applies the configuration and can subsequently be directed to execute attacker-controlled logic, yielding endpoint takeover. Public reporting from Cisco Talos and Sophos documents threat actors abusing Velociraptor deployments for remote access and ransomware staging, underscoring the practical risk of privilege gaps in artifact permissioning.

Detection Methods for CVE-2025-6264

Indicators of Compromise

Collection events referencing the Admin.Client.UpdateClientConfig artifact initiated by non-administrative users
Unexpected modifications to the Velociraptor client configuration file on managed endpoints
Client re-registration events pointing to unfamiliar server URLs or certificate authorities
Post-configuration-change execution of unusual child processes spawned by the Velociraptor agent

Detection Strategies

Audit the Velociraptor server audit log for collect_client actions targeting Admin.Client.UpdateClientConfig and correlate to the initiating user and role
Alert on any artifact collection by "Investigator" role accounts that touches administrative artifacts
Baseline Velociraptor client configuration hashes and detect drift on managed endpoints

Monitoring Recommendations

Forward Velociraptor server audit and query logs to a centralized SIEM for continuous review
Monitor role assignments and privilege changes on the Velociraptor server for unauthorized elevation
Track outbound connections from Velociraptor agents to detect redirection to attacker-controlled infrastructure

How to Mitigate CVE-2025-6264

Immediate Actions Required

Upgrade Velociraptor to the fixed release identified in the Velociraptor Advisory CVE-2025-6264
Review all users assigned the "Investigator" role and revoke access for accounts that do not require endpoint collection privileges
Rotate Velociraptor server certificates and API keys if unauthorized artifact collections are found in audit logs
Inspect managed endpoints for unexpected client configuration changes and re-deploy trusted configurations where drift is detected

Patch Information

Rapid7 has published a fix in the Velociraptor advisory. Administrators should consult the Velociraptor Advisory CVE-2025-6264 for the exact fixed version and apply the upgrade to all server instances. Additional context on real-world abuse is available in the Cisco Talos analysis and the Sophos report on Velociraptor abuse.

Workarounds

Remove the COLLECT_CLIENT permission from the "Investigator" role for users who do not require endpoint interaction
Implement a custom Access Control List (ACL) requiring SERVER_ADMIN or EXECVE permission on the Admin.Client.UpdateClientConfig artifact
Restrict Velociraptor server console access to trusted networks via network segmentation until the patch is deployed

bash

# Review Velociraptor users and roles for excessive COLLECT_CLIENT assignments
velociraptor --config server.config.yaml acl show <username>

# Revoke the Investigator role from a user pending remediation
velociraptor --config server.config.yaml acl grant <username> '{"roles": ["reader"]}'