CyberRota Analysis
AI-GeneratedWazuh versions 4.0.0 to 4.14.6 and 5.0.0-beta3 are vulnerable due to improper path handling in the cluster synchronization process, allowing a malicious cluster peer to exploit this flaw. By manipulating file paths, an attacker can overwrite critical configuration files, such as ossec.conf, potentially leading to arbitrary code execution upon service reload. Organizations using affected Wazuh versions should prioritize upgrading to the patched releases to mitigate this critical security risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Wazuh is a free and open source platform used for threat prevention, detection, and response. From 4.0.0 until 4.14.6 and 5.0.0-beta3, cluster.unmerge_info() in framework/wazuh/core/cluster/cluster.py constructs paths from peer-controlled merge_type and name values in a merged synchronization archive. process_files_from_worker() in framework/wazuh/core/cluster/master.py does not adequately confine the resulting path to the declared cluster item directory. A cluster peer holding the shared Fernet key can use traversal in files_metadata.json or a merged-file header to write files such as /var/ossec/etc/ossec.conf. Replacing ossec.conf can configure root-executed commands and lead to code execution when Wazuh services reload. This issue is fixed in versions 4.14.6 and 5.0.0-beta3.
Related CVEs
Other vulnerabilities affecting the same vendor(s)