Executive brief
Wazuh is a security platform used by organizations to monitor for threats and manage incident responses. A critical vulnerability has been identified that allows an attacker to take full control of the Wazuh server by executing malicious code. This could lead to a total compromise of the security monitoring infrastructure, allowing attackers to disable alerts or steal sensitive security data.
Technical details
An unsafe deserialization vulnerability exists in the Wazuh DistributedAPI (DAPI) due to the improper handling of JSON-serialized parameters. The root cause is located in the `as_wazuh_object` function within `framework/wazuh/core/cluster/common.py`. An attacker who can inject an unsanitized dictionary into a DAPI request or response can forge an unhandled exception (`__unhandled_exc__`) to evaluate arbitrary Python code. This can be triggered by any user with API access, including compromised dashboards, cluster servers, or in some cases, compromised agents. The vulnerability is addressed in version 4.9.1.
Affected products
- Wazuh Wazuh Server 4.4.0 to 4.9.0
Timeline
- 2025-02-10: disclosed: Initial CVE publication and GitHub advisory disclosure.
- 2025-02-10: patched: Fix released in version 4.9.1.
- 2025-06-10: kev added: CISA added the vulnerability to the Known Exploited Vulnerabilities (KEV) catalog.
- 2025-06-10: exploited: Vulnerability confirmed to be exploited in the wild.