Summary
A critical path traversal vulnerability in Wazuh cluster file-upload handlers allows malicious cluster workers to write files outside intended directories. An attacker who possesses the cluster key may submit crafted DistributedAPI requests that bypass REST controller validation and write files as the Wazuh user.
A critical path traversal vulnerability in Wazuh cluster file-upload handlers allows malicious cluster workers to write files outside intended directories. An attacker who possesses the cluster key may submit crafted DistributedAPI requests that bypass REST controller validation and write files as the Wazuh user.
Affected context
The vulnerability affects Wazuh deployments using vulnerable versions of the cluster file-upload functionality, including the upload_list_file, upload_rule_file, and upload_decoder_file handlers. Risk is present when a malicious or compromised cluster worker can communicate with the manager and the server-side handlers rely on insufficiently constrained filename paths.
The vulnerability affects Wazuh deployments using vulnerable versions of the cluster file-upload functionality, including the upload_list_file, upload_rule_file, and upload_decoder_file handlers. Risk is present when a malicious or compromised cluster worker can communicate with the manager and the server-side handlers rely on insufficiently constrained filename paths.
Exploit preconditions
- Attack surface: Wazuh cluster DistributedAPI file-upload handlers
- Required access: Possession of the cluster key and the ability to act as or compromise a cluster worker
- Trigger point: Processing an upload request for list, rule, or decoder files
- Why exploitation is possible: Filename path components are not sufficiently constrained by the handler, allowing traversal sequences to escape the intended upload directory after REST-layer validation has been bypassed
- Attack surface: Wazuh cluster DistributedAPI file-upload handlers
- Required access: Possession of the cluster key and the ability to act as or compromise a cluster worker
- Trigger point: Processing an upload request for list, rule, or decoder files
- Why exploitation is possible: Filename path components are not sufficiently constrained by the handler, allowing traversal sequences to escape the intended upload directory after REST-layer validation has been bypassed
Why this happens
The underlying flaw is improper neutralization of path elements supplied in filenames. The upload handlers trust a path derived from attacker-influenced input without reliably canonicalizing it and enforcing that the resulting path remains within an approved directory. This behavior maps to CWE-22: Improper Limitation of a Pathname to a Restricted Directory, commonly called path traversal.
The underlying flaw is improper neutralization of path elements supplied in filenames. The upload handlers trust a path derived from attacker-influenced input without reliably canonicalizing it and enforcing that the resulting path remains within an approved directory. This behavior maps to CWE-22: Improper Limitation of a Pathname to a Restricted Directory, commonly called path traversal.
Potential impact
- Arbitrary files may be created or overwritten as the Wazuh user
- Wazuh configuration, rule, or decoder integrity could be compromised
- Monitoring results and security detections may be altered or suppressed
- The attacker could gain additional execution opportunities depending on the files and paths affected
- Host or cluster compromise could follow if writable files are later trusted or executed by privileged components
- Arbitrary files may be created or overwritten as the Wazuh user
- Wazuh configuration, rule, or decoder integrity could be compromised
- Monitoring results and security detections may be altered or suppressed
- The attacker could gain additional execution opportunities depending on the files and paths affected
- Host or cluster compromise could follow if writable files are later trusted or executed by privileged components
General mitigation guidance
Mitigation generally focuses on treating uploaded filenames as untrusted metadata rather than filesystem paths.
Common defensive patterns include:
- Canonicalizing candidate paths and enforcing containment within a fixed upload directory
- Rejecting traversal components, absolute paths, and unexpected path separators
- Generating server-side filenames instead of accepting client-controlled filesystem names
- Applying strict allowlists for supported file types and upload destinations
- Separating upload directories from executable, configuration, and sensitive system locations
- Running Wazuh services with the minimum filesystem permissions required
- Preserving validation at the final file-handling boundary rather than relying only on upstream REST checks
Mitigation generally focuses on treating uploaded filenames as untrusted metadata rather than filesystem paths.
Common defensive patterns include:
- Canonicalizing candidate paths and enforcing containment within a fixed upload directory
- Rejecting traversal components, absolute paths, and unexpected path separators
- Generating server-side filenames instead of accepting client-controlled filesystem names
- Applying strict allowlists for supported file types and upload destinations
- Separating upload directories from executable, configuration, and sensitive system locations
- Running Wazuh services with the minimum filesystem permissions required
- Preserving validation at the final file-handling boundary rather than relying only on upstream REST checks
How teams detect issues like this
Detection approaches can include:
- Static analysis for direct path joins involving request-controlled filenames without canonicalization and containment checks
- Code review of all DistributedAPI upload handlers and filesystem write operations
- Runtime monitoring for unexpected writes by the Wazuh service account outside approved directories
- File-integrity monitoring for changes to Wazuh rules, decoders, lists, and configuration paths
- Policy enforcement requiring server-generated upload names and restricted destination directories
Automated security scanners and code-review tools may help identify traversal-prone path construction patterns.
Detection approaches can include:
- Static analysis for direct path joins involving request-controlled filenames without canonicalization and containment checks
- Code review of all DistributedAPI upload handlers and filesystem write operations
- Runtime monitoring for unexpected writes by the Wazuh service account outside approved directories
- File-integrity monitoring for changes to Wazuh rules, decoders, lists, and configuration paths
- Policy enforcement requiring server-generated upload names and restricted destination directories
Automated security scanners and code-review tools may help identify traversal-prone path construction patterns.
