CyberRota Analysis
AI-GeneratedWazuh versions 4.4.0 to 4.14.6 and 5.0.0-beta2 are vulnerable due to improper handling of Basic authentication usernames, allowing unauthenticated attackers to inject control characters that can forge log entries and obscure malicious activity. This could lead to compromised audit trails and potential exploitation by systems relying on plain-text logs. Organizations using affected versions should prioritize upgrading to versions 4.14.6 or 5.0.0-beta2 to mitigate this risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Wazuh is a free and open source platform used for threat prevention, detection, and response. From 4.4.0 until 4.14.6 and 5.0.0-beta2, api/api/middlewares.py decodes the Basic authentication username before credential validation and passes it to the access logger without neutralizing control characters. api/api/alogging.py interpolates that value into the plain-text API log. An unauthenticated attacker can include carriage returns or line feeds in the username to forge entries, obscure activity, or poison systems that consume the plain-text audit log. The JSON log format is not affected because JSON serialization escapes these characters. This issue is fixed in versions 4.14.6 and 5.0.0-beta2.