Executive brief
Wazuh is an open-source security platform that monitors endpoints and cloud infrastructure for threats and automatically responds to detected attacks. Multiple built-in response scripts fail to validate user input before passing it to privileged system commands, allowing an attacker who can inject crafted log events to execute arbitrary commands as root. This could enable an attacker to modify firewall rules, lock system accounts, or execute other privileged operations, compromising the security of protected systems.
Technical details
This vulnerability is an argument injection flaw (CWE-88) in Wazuh's active response framework. Five firewall scripts (route-null.c, netsh.c, pf.c, npf.c, ipfw.c) omit IP validation before passing the srcip field to commands like pfctl, npfctl, ipfw, and route running as root. Similarly, disable-account.c passes the dstuser field to passwd/chuser with minimal validation. An attacker can inject crafted log events via syslog (UDP/514) containing malicious srcip or dstuser values; when an active response rule triggers, these unvalidated strings are concatenated into command lines. On Windows, unquoted CreateProcess argument concatenation in wpopenv() allows srcip values with spaces to inject additional arguments. The vulnerability requires log injection capability but no elevated privileges to trigger exploitation. Patches are available in version 4.14.7, which adds centralized input validation (get_ip_version() for IPs, is_valid_username() for usernames) applied uniformly across all active response scripts.
Affected products
- Wazuh Wazuh Agent 4.2.0 to 4.14.6
- Wazuh Wazuh Manager 4.2.0 to 4.14.6
Timeline
- 2026-08-28: disclosed
- 2026-06-08: patched: Fix committed; version 4.14.7 released