InfoSecBulletin Cybersecurity for mankind
A critical security flaw has affected the open-source security community. Recently, complete details and working exploit code were shared online. This critical Wazuh flaw lets verified endpoints change central log systems directly. So, any company testing this new platform must take urgent action. If not, they risk major damage to their systems.
The Mechanics of the Injection Flaw
Microsoft Patches CVSS 10.0 Azure AI Foundry Vulnerability Allowing Privilege Escalation
AWS is unable to restore access to Bahrain, one UAE cloud data zone after war damage
Cisco Warns of Critical ISE 0-Day Flaw and Hackers Allegedly Selling Fortinet FortiGate 1-Day Flaw
Anthropic prepares “Claude Money” to analyze bank account and financial data
GhostCode Phishing Kit Evades Microsoft 365 MFA to Hijack Accounts in 78 Seconds
CISA Warns of Cisco Secure Email Gateway 0-Day Flaw Actively Exploited in Attacks
VPN flaw exposed 246,000 personnel records in japan
Hackers deploy Casbaneiro Trojan that activates on bank websites
German police read Signal, Telegram, WhatsApp messages without breaking encryption
Urgent Patch! cPanel, GitLab Flaws Expose Users to RCE, File and Credential Theft
The main reason for this serious flaw is a problem in the platform’s asset data flow. The technical report states that ‘The Wazuh 5.0 inventory flow sends a flatbuffer field (DataValue.index) from the agent right into an OpenSearch_bulk NDJSON request without escaping it.’ Because this is not escaped, a bad actor can easily add harmful characters into that field. As a result, untrustworthy endpoints can sneak unauthorized OpenSearch bulk actions into backend database requests. These actions operate using the manager’s high-level admin rights.
Severe Impact and Exploitation Risks
Exploiting this Wazuh CVSS 10 flaw can have serious effects on businesses. An attacker can run hidden commands and get harmful database access. For instance, they can delete any document across various data areas. This can change alerts and clean up after an attack. Also, bad actors can add lasting harmful code to saved dashboard items. So, they can easily wipe out important evidence. This makes it hard for security experts to respond during a network attack.
Keystore Credential Exposure
The platform also sends requests using credentials saved in its local keystore. By default, these roles are linked to admin accounts with full access. As a result, the hidden actions run with the highest database power.
Available Patches and Remediation
This flaw affects wazuh-manager installations from version 5.0.0-beta1. The older 4.x versions are not affected at all. This is because the sync path does not exist in those versions.
Luckily, the development team has released fixes in version 5.0.0-beta3. This version ensures proper character escaping. Network admins should quickly check the new technical details and code. This information can be found in the official Wazuh security notice on GitHub. Upgrading vulnerable managers is important to stop unauthorized OpenSearch bulk actions.
