Critical Vulnerability in Wazuh Server Exposes Remote Code Execution Risk

What changed

Wazuh Server has been identified with a significant deserialization of untrusted data vulnerability. This flaw allows attackers to execute arbitrary code remotely, posing a critical risk to the integrity of the server.

The vulnerability affects versions starting from 4.4.0 up to, but not including, 4.9.1, where unsafe deserialization of parameters from DistributedAPI can be exploited.

Who is affected

Various users and organizations utilizing Wazuh Server are at risk, particularly those running vulnerable versions.

The following groups are notably impacted:

• Organizations using Wazuh for threat detection and response.
• Users with API access to Wazuh servers, including compromised dashboards.
• Clusters of Wazuh servers that may interact with untrusted data.
• Administrators managing Wazuh installations in enterprise environments.

What to do

To mitigate the risks associated with this vulnerability, it is crucial for users to upgrade their Wazuh installations to the latest version. Regularly reviewing access controls and API security practices can also help reduce exposure.

Additionally, organizations should monitor for any suspicious activity that may indicate exploitation attempts.

• Upgrade Wazuh Server to version 4.9.1 or later.
• Implement strict access controls to the API.
• Regularly audit server configurations and permissions.
• Monitor logs for unusual API access patterns.