Description

Velociraptor's web GUI allows specifying a custom type for columns in tables. The URL type takes the cell value and forms a URL which can be clicked in the GUI.The code does not limit the schemes allowed in this URL , allowing an attacker to specify a JavaScript scheme exposing the user to XSS.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.1",
  "pubDate": "2026-08-18T07:16:48.927Z",
  "pubdate": "2026-08-18T07:16:48.927Z",
  "executiveSummary": "A Cross-Site Scripting (XSS) vulnerability exists in the Velociraptor web GUI due to insufficient input validation and lack of scheme restriction within custom table column types.\nSpecifically, the implementation of the URL type allows arbitrary URI schemes to be processed and rendered when a user interacts with a generated table cell link.\nAn authenticated attacker capable of defining or manipulating table column configurations can inject malicious payloads utilizing the JavaScript scheme.\nWhen a victimized user clicks the maliciously crafted URL within the graphical interface, the browser executes the embedded script in the context of the user's active session.\nSuccessful exploitation compromises the confidentiality and integrity of the user session, potentially allowing unauthorized actions within the Velociraptor deployment.\nThe risk implication is rated as significant for multi-tenant or collaborative environments where administrative or analyst privileges are segregated or where untrusted VQL queries can influence GUI rendering.",
  "technicalDetails": "The root cause of this vulnerability lies in the improper neutralization of input used for dynamic link generation within the Velociraptor web GUI table rendering engine.\nWhen rendering tables, the application supports a custom type configuration for columns. The URL type takes the raw cell value and dynamically constructs a hyperlink that is subsequently rendered for users to click.\nThe underlying code fails to implement an allowlist or restrict the permitted URI schemes (such as forcing http:// or https://), thereby permitting dangerous pseudo-protocols like javascript:.\nAttack Flow: 1. An attacker leverages an interface or query result mechanism that defines table column types and cell values. 2. The attacker crafts a payload utilizing the JavaScript scheme (e.g., javascript:alert(document.domain)) as the cell value mapped to the URL column type. 3. The Velociraptor web GUI processes the configuration and generates a DOM anchor element href attribute containing the unsanitized javascript: URI without adequate validation. 4. An authenticated user or administrator interacts with the generated table and clicks the hyperlinked cell within the GUI. 5. The browser evaluates the JavaScript URI scheme, resulting in the immediate execution of arbitrary script code within the security context of the victim's browser session.\nThe vulnerable component is the web GUI table rendering logic responsible for parsing and displaying custom column types.\nBecause the payload executes in the browser of the user who clicks the link, the attack inherits the privileges of that authenticated user session, potentially leading to session hijacking, unauthorized API calls, or further client-side exploitation against the Velociraptor server interface."
}