This vulnerability (CWE-863) in Rapid7 Velociraptor affects versions before 0.77.2 and arises from missing authorization checks in the upload_azure, upload_sftp, and upload_smb VQL plugins. An authenticated user with analyst role privileges can exploit this flaw to initiate outbound network connections controlled by the attacker, circumventing the NETWORK ACL restrictions. The impact includes the ability to perform internal network reconnaissance using port oracle techniques and the risk of data exfiltration to external endpoints. The CVSS 3.1 base score is 4.1 (medium), reflecting network attack vector, low attack complexity, high privileges required, no user interaction, scope changed, and limited confidentiality impact. The vulnerability affects the cloud-hosted Velociraptor service, with the vendor managing remediation server-side. No known exploits in the wild have been reported.

An authenticated analyst-role user can bypass network access control lists (ACLs) by initiating outbound connections from the Velociraptor server via vulnerable VQL plugins. This enables internal network reconnaissance and potential data exfiltration to external systems. The confidentiality impact is limited but notable due to the ability to bypass intended network restrictions. There is no impact on integrity or availability reported.

Since this is a cloud-hosted service, the vendor (Rapid7) manages remediation server-side. A patch is available for versions prior to 0.77.2. Users should verify with Rapid7's official advisory for confirmation of patch deployment and ensure their Velociraptor instances are updated to version 0.77.2 or later. No additional user action is required beyond applying the update or confirming the cloud service is patched.