Wazuh Token Validation Flaw Allows Privilege Retention

Executive Summary

Wazuh 4.0.0 before 4.14.8 has a flaw in the check_token function that fails to invalidate tokens for run_as users with zero static roles. Attackers with revoked administrator privileges can exploit this to retain access by authenticating and permanently self-linking the administrator role.

Useful 0 Not Useful 0

Detection Guidance

Check Wazuh version with 'curl -s http://localhost:55000/version | grep "version"' or 'wazuh-control -V'. If running 4.0.0 to 4.14.7, the system is vulnerable. Review API logs for unauthorized privilege escalation attempts or persistent administrator role assignments.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows attackers with revoked administrator privileges to retain permanent elevated access. They can authenticate and self-assign administrator rights indefinitely, bypassing revocation. This grants root access to the Wazuh manager, enabling full system control.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability violates compliance requirements for access control and auditability. It allows unauthorized privilege retention, which could lead to unauthorized data access or modifications. Organizations using Wazuh may fail to meet GDPR's data protection principles or HIPAA's access control requirements due to the inability to properly revoke privileges.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade Wazuh to version 4.14.8 or later immediately. If upgrading is not possible, disable the run_as feature or restrict administrator role assignments until patched. Monitor for unauthorized privilege escalations during the transition.

Useful 0 Not Useful 0