Security readout for executives and security teams
Plain-English summary
CVE-2022-35632 is a cross-site scripting issue in the Velociraptor web GUI. A feature that shows editor suggestions could display unsanitized description text from VQL functions, plugins, or artifacts. In practical terms, malicious or unsafe content shown in the GUI could run in a user's browser. Rapid7 says the issue was fixed in Velociraptor 0.6.5-2.
Executive priority
Prioritize remediation for Velociraptor deployments used in security operations, especially where many administrators access the GUI or untrusted content can enter artifact or plugin metadata. This is not supported as actively exploited in the supplied evidence, but the tool's role in incident response raises operational sensitivity.
Technical view
The flaw is CWE-79 XSS in Velociraptor's GUI editor suggestion rendering. The vulnerable path involves description fields for VQL functions, plugins, or artifacts being displayed without proper sanitization. The source bundle provides no CVSS vector, no affected-version range beyond the fix statement, and no technical exploitation details. Resolution is identified as Velociraptor 0.6.5-2.
Likely exposure
Exposure is most likely for organizations running Velociraptor GUI versions not updated to the Rapid7 fixed release. Risk depends on who can influence VQL function, plugin, or artifact description content and who uses the GUI. The provided sources do not define a precise vulnerable version range.
Exploitation context
The source bundle does not show CISA KEV listing, public exploitation, or in-the-wild activity. Treat this as a credible UI XSS risk with unknown exploit prevalence. Do not assume active exploitation without additional evidence from KEV or vendor advisories.
Researcher notes
Key unknowns are the exact affected version range, CVSS severity, and any exploit prerequisites. The advisory-level detail identifies the rendering surface and fixed version but does not provide enough evidence to assess exploit reliability, required privileges, or browser-session impact beyond general XSS risk.
Mitigation direction
- Upgrade Velociraptor to version 0.6.5-2 if not already fixed.
- Review Rapid7's advisory for any environment-specific guidance.
- Restrict Velociraptor GUI access to trusted administrators.
- Limit who can add or modify artifacts, plugins, or VQL-related content.
- Monitor vendor release notes for related Velociraptor security updates.
Validation and detection
- Confirm the deployed Velociraptor version is 0.6.5-2 or fixed per vendor guidance.
- Inventory Velociraptor GUI instances and their access controls.
- Review administrator accounts with permissions to modify artifacts or plugins.
- Check change history for recently added artifact or plugin descriptions.
- Document remaining uncertainty where version evidence is incomplete.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-79: User-session and phishing behavior lookup
Client-side and session-facing weaknesses should be reviewed alongside initial-access and user-execution behaviors. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2022-35632 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS and timeline data
No CVSS vectors or timeline events were available in the normalized CVE source material.
Source materials
- CVE List V5 sourceCVE List V5
- https://www.rapid7.com/blog/post/2022/07/26/cve-2022-35629-35632-velociraptor-multiple-vulnerabilities-fixed/CVE reference · x_refsource_CONFIRM
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.