CyberRota Analysis
AI-GeneratedWazuh versions 4.0.0 to 4.14.6 and 5.0.0-beta3 are vulnerable due to a flaw in the DistributedAPI.send_tmp_file() function, which improperly handles attacker-controlled file paths, allowing unauthorized access to sensitive files. This vulnerability can lead to the exposure of the private key, enabling an attacker to forge administrator REST API tokens and gain administrative privileges without authentication. Organizations using affected versions should prioritize patching to mitigate the risk of unauthorized access and potential compromise of their security infrastructure.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Wazuh is a free and open source platform used for threat prevention, detection, and response. From 4.0.0 until 4.14.6 and 5.0.0-beta3, DistributedAPI.send_tmp_file() in framework/wazuh/core/cluster/dapi/dapi.py joins an attacker-controlled tmp_file value to WAZUH_PATH without canonicalization or confinement. A cluster peer holding the shared Fernet key can use traversal or an absolute path to make the master return any readable file over the cluster channel. Reading /var/ossec/api/configuration/security/private_key.pem allows the peer to forge administrator REST API tokens offline and then exercise administrative privileges without creating an account. This issue is fixed in versions 4.14.6 and 5.0.0-beta3.
Related CVEs
Other vulnerabilities affecting the same vendor(s)