Summary
Wazuh contains an authorization flaw in SCA policy handling where trust is inferred from a file path instead of the policy's configuration source. An attacker who controls a manager may be able to introduce an unsigned policy and cause agents to execute command checks with root privileges.
Wazuh contains an authorization flaw in SCA policy handling where trust is inferred from a file path instead of the policy's configuration source. An attacker who controls a manager may be able to introduce an unsigned policy and cause agents to execute command checks with root privileges.
Affected context
The issue occurs in Wazuh deployments that use SCA policies delivered through the manager upgrade channel. It becomes risky when an attacker can write policy content into the manager's incoming directory and reference that content as a trusted policy, allowing agent-side checks to run without adequate authenticity validation.
The issue occurs in Wazuh deployments that use SCA policies delivered through the manager upgrade channel. It becomes risky when an attacker can write policy content into the manager's incoming directory and reference that content as a trusted policy, allowing agent-side checks to run without adequate authenticity validation.
Exploit preconditions
- Attack surface: Wazuh manager-to-agent policy distribution and SCA policy processing
- Required access: Control of, or sufficient privileges on, a Wazuh manager to place policy files through the upgrade channel
- Trigger point: Agent processing of a referenced SCA policy and execution of its command checks
- Why exploitation is possible: Authorization is based on the policy file path rather than the source and authenticity of the configuration, allowing unsigned content to be treated as trusted
- Attack surface: Wazuh manager-to-agent policy distribution and SCA policy processing
- Required access: Control of, or sufficient privileges on, a Wazuh manager to place policy files through the upgrade channel
- Trigger point: Agent processing of a referenced SCA policy and execution of its command checks
- Why exploitation is possible: Authorization is based on the policy file path rather than the source and authenticity of the configuration, allowing unsigned content to be treated as trusted
Why this happens
The underlying bug is an authorization decision based on location rather than provenance. A policy stored in an expected directory is treated as trusted without adequately verifying that it originated from an authorized configuration source or carries an acceptable integrity signal. This maps to CWE-863: Incorrect Authorization, because the system permits a privileged operation without correctly enforcing the required trust boundary.
The underlying bug is an authorization decision based on location rather than provenance. A policy stored in an expected directory is treated as trusted without adequately verifying that it originated from an authorized configuration source or carries an acceptable integrity signal. This maps to CWE-863: Incorrect Authorization, because the system permits a privileged operation without correctly enforcing the required trust boundary.
Potential impact
- Attackers may execute arbitrary commands on Wazuh agents with root privileges
- Agent hosts could be compromised or used for lateral movement
- Monitoring data and security telemetry may be altered or suppressed
- Attackers could use compromised agents to access local secrets or services
- Fleet-wide impact could occur if the same malicious policy reaches multiple agents
- Attackers may execute arbitrary commands on Wazuh agents with root privileges
- Agent hosts could be compromised or used for lateral movement
- Monitoring data and security telemetry may be altered or suppressed
- Attackers could use compromised agents to access local secrets or services
- Fleet-wide impact could occur if the same malicious policy reaches multiple agents
General mitigation guidance
Mitigation generally focuses on making policy trust explicit and independent of filesystem location.
Common defensive patterns include:
- Require cryptographic integrity and authenticity validation for distributed SCA policies
- Bind policy acceptance to an authorized configuration source, not merely an expected path
- Reject unsigned, unverified, or unexpected policy content by default
- Restrict manager upgrade-channel write permissions and protect incoming directories
- Run agents and policy checks with the minimum privileges needed for their functions
- Separate policy distribution privileges from general manager administration where practical
- Apply strong monitoring and access controls to manager-to-agent communication
Mitigation generally focuses on making policy trust explicit and independent of filesystem location.
Common defensive patterns include:
- Require cryptographic integrity and authenticity validation for distributed SCA policies
- Bind policy acceptance to an authorized configuration source, not merely an expected path
- Reject unsigned, unverified, or unexpected policy content by default
- Restrict manager upgrade-channel write permissions and protect incoming directories
- Run agents and policy checks with the minimum privileges needed for their functions
- Separate policy distribution privileges from general manager administration where practical
- Apply strong monitoring and access controls to manager-to-agent communication
How teams detect issues like this
Organizations can look for:
- Static and semantic analysis of authorization decisions based solely on file paths or directory membership
- Code review signals where unsigned configuration is accepted because it resides in a trusted location
- Tests confirming that untrusted or modified policy files are rejected before command checks run
- Audit records for unexpected policy creation, replacement, or distribution through upgrade channels
- Endpoint monitoring for unusual root-level command execution by agent processes
- Policy enforcement requiring integrity verification for configuration distributed across hosts
Automated security review tools can help identify path-based trust assumptions and missing authorization checks.
Organizations can look for:
- Static and semantic analysis of authorization decisions based solely on file paths or directory membership
- Code review signals where unsigned configuration is accepted because it resides in a trusted location
- Tests confirming that untrusted or modified policy files are rejected before command checks run
- Audit records for unexpected policy creation, replacement, or distribution through upgrade channels
- Endpoint monitoring for unusual root-level command execution by agent processes
- Policy enforcement requiring integrity verification for configuration distributed across hosts
Automated security review tools can help identify path-based trust assumptions and missing authorization checks.
