Wazuh Manager Unauthenticated Path Traversal Vulnerability in Enrollment and Synchronization Daemons

A logic flaw has been identified in Wazuh Manager versions 4.0.0 through 4.10.3 and 4.11.0 through 4.14.4. The vulnerability resides in the enrollment daemon (authd) and synchronization daemon (remoted). During the enrollment process, the authd daemon allows agents to specify a group but fails to properly sanitize the group name, enabling path traversal attacks. This unchecked group name is then used by the remoted daemon to access agent configuration files, inadvertently exposing sensitive data such as client.keys, ossec.conf, and internal certificates to the agent. This issue has been resolved in Wazuh versions 4.10.4 and 4.14.5.

Impact

Exploitation of this vulnerability allows for unauthorized access to sensitive files in the Wazuh Manager's configuration directory, including encryption keys and internal certificates. The exposure of the client.keys file is particularly critical, as it contains keys for agent authentication and could be used to manipulate agent communications or trust relationships, jeopardizing the security of the entire monitored system.

Reproduction

To reproduce this vulnerability, enroll an agent with a group name that includes path traversal sequences, such as '..,default'. The authd process will accept the group name without proper validation, allowing it to traverse directories. Once the group is accepted, the remoted process will use the traversed path to access files in the Wazuh Manager's etc directory, including sensitive configuration files and keys.

Remediation

Users can upgrade to Wazuh versions 4.10.4 or 4.14.5 to address this vulnerability. For those unable to upgrade, it is recommended to implement strict validation of group names in the enrollment daemon to prevent the use of path traversal sequences.