CyberRota Analysis
AI-GeneratedWazuh workflows prior to version 44bf114 are vulnerable to shell injection through GitHub Actions, allowing attackers to execute arbitrary commands by exploiting crafted VERSION.json files in pull requests. This vulnerability can lead to the exfiltration of sensitive information, such as GITHUB_TOKEN and AWS credentials, particularly on self-hosted runners. Organizations using Wazuh with GitHub Actions should prioritize remediation to safeguard their environments against potential command execution and data breaches.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Wazuh workflows before 44bf114 contain a shell injection vulnerability in GitHub Actions that allows attackers to execute arbitrary commands by submitting pull requests with crafted VERSION.json files. Attackers can inject shell metacharacters into environment variables that are directly interpolated into run steps, enabling command execution and exfiltration of secrets including GITHUB_TOKEN and AWS credentials on self-hosted runners.