Summary
A missing-authorization flaw in Wazuh allows a compromised or malicious cluster worker to overwrite protected files on the manager. Under cluster configurations where workers can submit file-processing requests, this may enable modification of security-critical configuration and lead to root-level remote code execution across the manager and connected agents.
A missing-authorization flaw in Wazuh allows a compromised or malicious cluster worker to overwrite protected files on the manager. Under cluster configurations where workers can submit file-processing requests, this may enable modification of security-critical configuration and lead to root-level remote code execution across the manager and connected agents.
Affected context
The vulnerability occurs in Wazuh cluster deployments that allow worker-to-master file processing through MasterHandler.process_files_from_worker. It becomes risky when authorization checks do not adequately restrict destination paths, including cases where path handling and basename validation interpret protected files as permitted targets. Configurations such as ossec.conf and agent.conf may be exposed to this behavior.
The vulnerability occurs in Wazuh cluster deployments that allow worker-to-master file processing through MasterHandler.process_files_from_worker. It becomes risky when authorization checks do not adequately restrict destination paths, including cases where path handling and basename validation interpret protected files as permitted targets. Configurations such as ossec.conf and agent.conf may be exposed to this behavior.
Exploit preconditions
- Attack surface: Wazuh cluster communication between a worker and the master
- Required access: Control of, or the ability to send requests as, a cluster worker
- Trigger point: Worker file-processing requests handled by the master
- Why exploitation is possible: Destination authorization and extra_valid enforcement
are insufficient, allowing protected master files to be treated as writable targets
- Attack surface: Wazuh cluster communication between a worker and the master
- Required access: Control of, or the ability to send requests as, a cluster worker
- Trigger point: Worker file-processing requests handled by the master
- Why exploitation is possible: Destination authorization and extra_valid enforcement
are insufficient, allowing protected master files to be treated as writable targets
Why this happens
The underlying bug is an authorization failure mapped to CWE-862, Missing Authorization. The file-processing path does not consistently enforce whether a requested destination is permitted, and path or basename handling can bypass intended restrictions. This insecure pattern permits a lower-trust cluster participant to perform a protected file-write operation on the master.
The underlying bug is an authorization failure mapped to CWE-862, Missing Authorization. The file-processing path does not consistently enforce whether a requested destination is permitted, and path or basename handling can bypass intended restrictions. This insecure pattern permits a lower-trust cluster participant to perform a protected file-write operation on the master.
Potential impact
- Protected manager configuration files could be overwritten
- Security controls and cluster behavior could be altered
- The Wazuh manager may execute attacker-controlled configuration effects with root privileges
- Connected agents could receive or apply malicious configuration changes
- Attackers could achieve broader compromise across the Wazuh deployment
- Protected manager configuration files could be overwritten
- Security controls and cluster behavior could be altered
- The Wazuh manager may execute attacker-controlled configuration effects with root privileges
- Connected agents could receive or apply malicious configuration changes
- Attackers could achieve broader compromise across the Wazuh deployment
General mitigation guidance
Mitigation generally focuses on enforcing authorization at every file-processing
boundary and reducing the trust granted to cluster workers.
Common defensive patterns include:
- Apply allowlists for writable files and canonicalize paths before authorization checks
- Enforce extra validation consistently for every requested destination
- Reject ambiguous path forms and prevent writes outside dedicated data directories
- Separate worker-submitted data from protected manager configuration
- Run managers and agents with the least privileges compatible with their functions
- Protect cluster credentials, authenticate workers strongly, and limit worker membership
- Use read-only or policy-protected handling for critical configuration files where practical
Mitigation generally focuses on enforcing authorization at every file-processing
boundary and reducing the trust granted to cluster workers.
Common defensive patterns include:
- Apply allowlists for writable files and canonicalize paths before authorization checks
- Enforce extra validation consistently for every requested destination
- Reject ambiguous path forms and prevent writes outside dedicated data directories
- Separate worker-submitted data from protected manager configuration
- Run managers and agents with the least privileges compatible with their functions
- Protect cluster credentials, authenticate workers strongly, and limit worker membership
- Use read-only or policy-protected handling for critical configuration files where practical
How teams detect issues like this
Detection can combine:
- Static analysis for file-write operations that authorize paths before canonicalization
- Code review checks for missing authorization or validation on worker-originated requests
- Runtime monitoring of unexpected changes to ossec.conf, agent.conf, and other protected files
- File-integrity monitoring with alerts for manager configuration modifications
- Cluster policy enforcement that restricts worker identities and writable destinations
- Automated security review tools that flag path validation and authorization inconsistencies
Detection can combine:
- Static analysis for file-write operations that authorize paths before canonicalization
- Code review checks for missing authorization or validation on worker-originated requests
- Runtime monitoring of unexpected changes to ossec.conf, agent.conf, and other protected files
- File-integrity monitoring with alerts for manager configuration modifications
- Cluster policy enforcement that restricts worker identities and writable destinations
- Automated security review tools that flag path validation and authorization inconsistencies
