search

Velocidex / velociraptor

Digging Deeper....
https://docs.velociraptor.app/
Other
2.91k stars 481 forks source link

Older clients can no longer fetch data from parameter type "upload" due to WSS-only URI #3581

Closed misje closed 2 months ago

misje commented 3 months ago

If an artifact has a parameter of type "upload", the resulting URI is using the scheme wss:// in the latest release. Older clients do not support this. A very similar problem was fixed in #3345, so I suppose a similar fix could be applied here?

predictiple commented 3 months ago

Noted here too: https://github.com/Velocidex/velociraptor/pull/3509#issuecomment-2125790409

misje commented 3 months ago

I couldn't find that one when I searched for the error message.

Is there a workaround for this? WSS is not enabled in the server nor the client. I get unsupported protocol scheme "wss".

scudette commented 3 months ago

The wss:// comes from the server.config.yaml under Client.serve_urls. The url is calculated by the server when the GUI uploads the file here

https://github.com/Velocidex/velociraptor/blob/78ddadfa980b620db2d2b0b65db902f82543aeec/paths/forms.go#L60

If you dont use wss just make sure the first server url is a https URL.

misje commented 3 months ago

Only https is used. Anyway, I realised now that I have to re-upload the file in order to produce a https link as a parameter. It was not obvious to me until I checked the resulting parameter string in the collection.

scudette commented 3 months ago

Yes the URL is provided in the form by the GUI which gets it once it uploads the file - so if you want to change the URL you need to reupload it in the GUI

scudette commented 2 months ago

Fixed in 0.72.4