Brute Force Protection Bypass in Wazuh Server API

Executive Summary

This vulnerability affects Wazuh server API versions from 4.0.0 to before 4.14.4. It allows an attacker to bypass the brute-force protection on the POST /security/user/authenticate endpoint by sending multiple concurrent authentication requests.

While the system correctly enforces a maximum number of failed login attempts (default 50) for sequential requests, it does not properly handle parallel bursts of requests. This means an attacker can make significantly more failed login attempts than intended before the IP address is blocked.

For example, instead of being limited to 50 failed attempts, an attacker could potentially make 100 failed attempts in parallel, increasing the chance of guessing passwords.

This issue was fixed in version 4.14.4 of Wazuh.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by monitoring the authentication requests to the POST /security/user/authenticate endpoint on the Wazuh server API. Specifically, detection involves identifying bursts of concurrent failed login attempts that exceed the configured max_login_attempts threshold without triggering immediate IP blocking.

A proof-of-concept shows that sending a high number of concurrent authentication requests (e.g., 100) results in many 401 Unauthorized responses without 403 Forbidden responses during the burst, indicating the brute-force protection bypass.

To detect this on your system, you can analyze your web server or Wazuh API logs for patterns of multiple simultaneous 401 responses from the same IP address without immediate 403 blocking.

Suggested commands might include using tools like curl or custom scripts to simulate concurrent POST requests to the /security/user/authenticate endpoint and monitoring the HTTP response codes.

• Use curl in a loop or parallel execution to send multiple concurrent POST requests to the authentication endpoint.
• Check logs for repeated 401 responses from the same IP without corresponding 403 responses during the burst.
• Example command to simulate concurrent requests (using GNU parallel):

parallel -j 100 curl -X POST https://<wazuh-server>/security/user/authenticate -d '{"user":"invalid","password":"invalid"}' ::: {1..100}

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can increase the risk of unauthorized access to your Wazuh server by allowing attackers to perform more password guessing attempts than intended.

By bypassing the brute-force protection, attackers have a higher chance of successfully guessing user credentials, which could lead to compromised accounts.

Compromised accounts could allow attackers to gain access to sensitive threat detection and response data, potentially undermining your security posture.

Useful 0 Not Useful 0

Compliance Impact

The vulnerability allows an attacker to bypass brute-force protection on the Wazuh server API, enabling more password guesses than intended by the security policy. This could potentially increase the risk of unauthorized access to sensitive systems or data.

While the CVE description and resources do not explicitly mention compliance with standards such as GDPR or HIPAA, the increased risk of unauthorized access due to this vulnerability could impact an organization's ability to maintain compliance with regulations that require strong access controls and protection of sensitive data.

Organizations relying on Wazuh for threat prevention and detection should ensure they update to version 4.14.4 or later to mitigate this issue and maintain compliance with security best practices.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, you should upgrade Wazuh to version 4.14.4 or later, where the issue has been patched.

Useful 0 Not Useful 0