Summary
SOCFortress CoPilot uses a publicly known fallback header value to authenticate selected Graylog and Velociraptor webhook endpoints when deployment-specific secrets are unset or unchanged. An anonymous caller who supplies that value may bypass normal JWT authentication, invoke active-response operations, forge incident alerts, and influence backend queries.
SOCFortress CoPilot uses a publicly known fallback header value to authenticate selected Graylog and Velociraptor webhook endpoints when deployment-specific secrets are unset or unchanged. An anonymous caller who supplies that value may bypass normal JWT authentication, invoke active-response operations, forge incident alerts, and influence backend queries.
Affected context
The issue affects CoPilot deployments before 0.1.76 where GRAYLOG_API_HEADER_VALUE or VELOCIRAPTOR_API_HEADER_VALUE remains unset or uses the publicly shipped fallback. The exposed webhook routes use this fallback as an alternative authentication mechanism, while the Graylog invocation path also accepts attacker-controlled command-related fields without the validation applied by the authenticated route. Active-response consequences depend on a reachable, configured Wazuh manager.
The issue affects CoPilot deployments before 0.1.76 where GRAYLOG_API_HEADER_VALUE or VELOCIRAPTOR_API_HEADER_VALUE remains unset or uses the publicly shipped fallback. The exposed webhook routes use this fallback as an alternative authentication mechanism, while the Graylog invocation path also accepts attacker-controlled command-related fields without the validation applied by the authenticated route. Active-response consequences depend on a reachable, configured Wazuh manager.
Exploit preconditions
- Attack surface: Network-accessible Graylog or incident webhook endpoints
- Required access: No valid JWT is required when the known fallback header value is accepted
- Trigger point: Requests to the Graylog invocation or incident alert creation routes
- Why exploitation is possible: Unchanged default authentication material is accepted as a trusted credential, and selected webhook handlers apply weaker authorization and validation than normal APIs
- Environmental dependency: Active-response delivery requires a configured and reachable Wazuh manager
- Attack surface: Network-accessible Graylog or incident webhook endpoints
- Required access: No valid JWT is required when the known fallback header value is accepted
- Trigger point: Requests to the Graylog invocation or incident alert creation routes
- Why exploitation is possible: Unchanged default authentication material is accepted as a trusted credential, and selected webhook handlers apply weaker authorization and validation than normal APIs
- Environmental dependency: Active-response delivery requires a configured and reachable Wazuh manager
Why this happens
The vulnerability combines missing authentication with the use of a publicly known hardcoded credential fallback. Webhook handlers treat that shared default value as sufficient authentication when deployment-specific secrets are absent or unchanged, allowing anonymous callers to reach privileged functionality. The Graylog path further fails to enforce the command restrictions used by the authenticated invocation route. This maps primarily to CWE-306, Missing Authentication for Critical Function, and is also associated with CWE-798, Use of Hard-coded Credentials.
The vulnerability combines missing authentication with the use of a publicly known hardcoded credential fallback. Webhook handlers treat that shared default value as sufficient authentication when deployment-specific secrets are absent or unchanged, allowing anonymous callers to reach privileged functionality. The Graylog path further fails to enforce the command restrictions used by the authenticated invocation route. This maps primarily to CWE-306, Missing Authentication for Critical Function, and is also associated with CWE-798, Use of Hard-coded Credentials.
Potential impact
- An attacker may invoke active-response scripts through a configured Wazuh manager.
- Endpoint controls may be disrupted or defensive settings may be manipulated.
- Attackers could forge incident alerts for arbitrary customer_code values.
- Attacker-controlled inputs may influence OpenSearch query activity.
- Security monitoring, investigation accuracy, and response workflows could be degraded.
- An attacker may invoke active-response scripts through a configured Wazuh manager.
- Endpoint controls may be disrupted or defensive settings may be manipulated.
- Attackers could forge incident alerts for arbitrary customer_code values.
- Attacker-controlled inputs may influence OpenSearch query activity.
- Security monitoring, investigation accuracy, and response workflows could be degraded.
General mitigation guidance
Mitigation generally focuses on eliminating shared public fallback credentials
and ensuring every privileged webhook has deployment-specific authentication.
Common defensive patterns include:
- Require strong, independently generated secrets for each integration.
- Fail closed when required authentication settings are missing or default.
- Use separate credentials and trust boundaries for Graylog and Velociraptor integrations.
- Apply the same authorization, command allowlisting, and input validation to webhook routes as to authenticated API routes.
- Restrict accepted customer identifiers and construct OpenSearch queries through validated parameterized interfaces.
- Limit Wazuh manager permissions and network reachability to the minimum required for active response.
- Rotate exposed integration secrets and prevent default credentials from being distributed in example configuration.
Mitigation generally focuses on eliminating shared public fallback credentials
and ensuring every privileged webhook has deployment-specific authentication.
Common defensive patterns include:
- Require strong, independently generated secrets for each integration.
- Fail closed when required authentication settings are missing or default.
- Use separate credentials and trust boundaries for Graylog and Velociraptor integrations.
- Apply the same authorization, command allowlisting, and input validation to webhook routes as to authenticated API routes.
- Restrict accepted customer identifiers and construct OpenSearch queries through validated parameterized interfaces.
- Limit Wazuh manager permissions and network reachability to the minimum required for active response.
- Rotate exposed integration secrets and prevent default credentials from being distributed in example configuration.
How teams detect issues like this
Detection can include:
- Static analysis and configuration checks for hardcoded secrets, public fallback values, and authentication branches that accept defaults.
- Code review of webhook handlers for missing JWT or equivalent authorization enforcement.
- Comparison of validation and authorization behavior between webhook and authenticated routes.
- Monitoring for requests to Graylog and incident alert endpoints using default or repeated header values.
- Alerts for unexpected active-response commands, unusual agent identifiers, forged customer codes, and anomalous OpenSearch query patterns.
- CI policy enforcement that rejects default secrets and requires explicit integration credentials.
Automated code review and secret-scanning tools may help identify these patterns early.
Detection can include:
- Static analysis and configuration checks for hardcoded secrets, public fallback values, and authentication branches that accept defaults.
- Code review of webhook handlers for missing JWT or equivalent authorization enforcement.
- Comparison of validation and authorization behavior between webhook and authenticated routes.
- Monitoring for requests to Graylog and incident alert endpoints using default or repeated header values.
- Alerts for unexpected active-response commands, unusual agent identifiers, forged customer codes, and anomalous OpenSearch query patterns.
- CI policy enforcement that rejects default secrets and requires explicit integration credentials.
Automated code review and secret-scanning tools may help identify these patterns early.
