OSSEC HIDS Agent for Windows Improper Input Validation Vulnerability Allowing UNC Path Manipulation and Credential Leakage

A vulnerability exists in the OSSEC HIDS agent for Windows, in versions prior to 3.8.0, due to improper input validation. This flaw allows an attacker with control over the OSSEC server or in possession of the agent's key to configure the agent to connect to a malicious UNC path. Consequently, this manipulation leads to the leakage of the machine account's NetNTLMv2 hash. This hash can be relayed to execute remote code or used to escalate privileges to SYSTEM by forging AD CS certificates, among other similar attacks.

Impact

Exploitation of this vulnerability results in the unauthorized disclosure of the NetNTLMv2 hash, which can be relayed for remote code execution or used to escalate privileges to SYSTEM through Active Directory Certificate Services certificate forging and related attacks.