Threat Intelligence Database

Wazuh 4.4.0 before 4.14.7 contains a denial of service vulnerability in the fdecompress_files() function within cluster.py that allows authenticated cluster peers to exhaust memory by supplying a malicious synchronization archive without decompressed size limits. Attackers holding a valid cluster Fernet key can upload a small, highly compressed zip bomb archive that forces wazuh-clusterd on the master node to decompress the full payload into memory, causing memory exhaustion and service disruption.

Wazuh wazuh-manager versions 4.0.0 through before 4.14.6 contain a path traversal vulnerability. Authenticated cluster peers with a valid Fernet key can supply a crafted node name in the cluster hello payload to trigger deletion of arbitrary directory contents within the Wazuh installation path writable by the wazuh user. This vulnerability allows unauthorized deletion of files by exploiting the master's peer cleanup routine.

Wazuh 4.0.0 before 4.14.7 and 5.0.0-beta2 contain a denial of service vulnerability that allows authenticated attackers with allow_run_as enabled to exhaust CPU resources by submitting arbitrarily deeply nested JSON structures to the POST /security/user/authenticate/run_as endpoint. Attackers can repeatedly submit malformed auth_context bodies with unlimited nesting depth to cause the API framework to consume excessive CPU, denying service to all other API consumers.

Wazuh wazuh-manager versions from 4.0.0 up to but not including 4.14.6 contain a path traversal vulnerability. This flaw allows unauthenticated remote attackers to cause a denial of service by enrolling an agent with a specially crafted name containing dot-sequences such as "..". The vulnerability arises from insufficient validation of agent names and unsafe path concatenation, which leads to deletion of critical directories and stoppage of Wazuh services requiring manual recovery.

Wazuh Manager authd service in wazuh-manager packages through version 4.7.3 contains an improper restriction of client-initiated SSL/TLS renegotiation vulnerability that allows remote attackers to cause a denial of service by sending excessive renegotiation requests. Attackers can exploit the lack of renegotiation limits to consume CPU resources and render the authd service unavailable.