CyberRota Analysis
AI-GeneratedWazuh versions 4.0.0 through 4.10.3 and 4.11.0 through 4.14.4 are vulnerable due to a logic flaw in the enrollment and synchronization daemons, allowing attackers to exploit path traversal sequences to access sensitive configuration files. This vulnerability can lead to unauthorized exposure of critical data, including client keys and internal certificates, posing a significant risk to the integrity and confidentiality of the system. Organizations using affected versions should prioritize upgrading to versions 4.10.4 or 4.14.5 to mitigate this high-severity risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Wazuh is a free and open source platform used for threat prevention, detection, and response. In versions 4.0.0 through 4.10.3 and 4.11.0 through 4.14.4, a logic flaw affects the Wazuh Manager's enrollment daemon (authd) and synchronization daemon (remoted). The authd process allows agents to select a group during enrollment but does not filter path traversal sequences such as "..." While the manager checks for the group directory using wopendir(), the ".." sequence references the parent directory (/var/ossec/etc), allowing it to pass validation. After the malicious group is accepted and stored in the manager's global database, the remoted process uses this unchecked value to build paths for agent configuration synchronization. As a result, sensitive files from /var/ossec/etc, such as client.keys, ossec.conf, and internal certificates, are included in the agent's shared configuration stream and exposed to the attacker. This issue has been fixed in versions 4.10.4 and 4.14.5.
Related CVEs
Other vulnerabilities affecting the same vendor(s)