Path Traversal in Wazuh Agent Enrollment

Executive Summary

This is a path traversal vulnerability in Wazuh versions 4.0.0 to 4.14.5. It allows unauthenticated remote attackers to cause a denial of service by enrolling an agent with a name containing path traversal sequences like '..'. The flaw stems from insufficient validation in OS_IsValidName() and unsafe path handling in delete_diff(), enabling attackers to traverse to the parent queue directory and delete critical subdirectories. This disrupts all Wazuh services, requiring manual recovery.

Useful 0 Not Useful 0

Detection Guidance

Check Wazuh Manager logs for agent enrollment attempts with suspicious names containing '..' or starting with a dot. Monitor for unexpected directory deletions in /var/ossec/queue/ or subdirectories. Verify OS_IsValidName() function behavior by testing agent name validation with edge cases like '..' or '.test'.

Useful 0 Not Useful 0

Impact Analysis

If exploited, this vulnerability can cause a complete denial of service for Wazuh services. Attackers can delete critical directories, stopping all Wazuh operations. This requires manual intervention to restore functionality, potentially leading to extended downtime and loss of security monitoring capabilities.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could impact compliance with GDPR and HIPAA by disrupting Wazuh services, which are often used for security monitoring and logging in regulated environments. A denial of service could lead to loss of audit trails or security event tracking, violating data integrity and availability requirements under these regulations.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade Wazuh Manager to version 4.14.6 or later to apply the patched OS_IsValidName() function. Block external agent enrollment requests at the network perimeter if not required. Review and remove any agents with suspicious names like '..' or starting with a dot. Monitor system logs for signs of exploitation attempts.

Useful 0 Not Useful 0