Listen to this Post
CVE-2026-39359 is a critical logic flaw discovered in the Wazuh Manager, affecting its enrollment daemon (authd) and synchronization daemon (remoted). Wazuh is a widely deployed open-source security platform for threat detection and response. The vulnerability stems from improper input validation during the agent enrollment process. Specifically, the authd daemon allows new agents to specify a group name during registration. However, it fails to filter path traversal sequences such as .., which can reference parent directories. While the manager performs a basic validation using `wopendir()` to check if the group directory exists, this check does not prevent the use of `..` because the function resolves the path relative to the base group directory (/var/ossec/etc/shared). The traversal sequence `..` effectively points to /var/ossec/etc, which is a valid directory, thus bypassing the validation. Once the malicious group name is accepted and stored in the manager’s global database, the remoted daemon later uses this unchecked value to construct file paths for agent configuration synchronization. As a result, when an agent requests its configuration, the remoted process reads and sends files from the `/var/ossec/etc` directory, including sensitive files like client.keys, ossec.conf, and internal SSL certificates. This exposure allows an attacker to retrieve critical security artifacts, potentially leading to full compromise of the Wazuh deployment. The vulnerability affects all versions from 4.0.0 to 4.10.3 and 4.11.0 to 4.14.4. Patches are available in versions 4.10.4 and 4.14.5. The CVSS score, as referenced by NVD, is not explicitly provided in the snippet but given the impact, it is likely critical.
DailyCVE Form
Platform: Wazuh Manager
Version: 4.0.0-4.14.4
Vulnerability: Path Traversal
Severity: Critical
date: 2026-07-16
Prediction: 2026-07-20
What Undercode Say: Analytics
The vulnerability exposes sensitive configuration files via the agent synchronization stream. An attacker can enumerate and extract files by setting the group parameter to `../etc` during enrollment. The following bash commands demonstrate the exploitation flow:
Simulate agent enrollment with malicious group echo "enroll-agent -g ../etc -n attacker-agent" | /var/ossec/bin/agent-auth -m MANAGER_IP After enrollment, the agent requests its configuration The remoted daemon will send files from /var/ossec/etc Example: client.keys, ossec.conf, sslmanager.key, etc.
The flaw exists in the `authd` source code where the group name is not sanitized:
// Vulnerable code snippet (pseudo)
char group_path[bash];
snprintf(group_path, sizeof(group_path), "/var/ossec/etc/shared/%s", group_name);
if (wopendir(group_path) != NULL) {
// Accept group, store in DB
}
The `wopendir()` call succeeds for `../etc` because `/var/ossec/etc` exists, bypassing the intended restriction.
Exploit
An unauthenticated attacker can exploit this vulnerability by enrolling a new agent with a crafted group name containing path traversal sequences. The steps are:
1. Send an enrollment request to the Wazuh Manager (port 1515/tcp) with the group parameter set to `../etc` or similar.
2. The manager accepts the enrollment and stores the malicious group in its database.
3. The attacker then triggers a configuration synchronization request from the agent.
4. The remoted daemon uses the stored group name to build the path `/var/ossec/etc/shared/../etc` which resolves to /var/ossec/etc.
5. The manager streams the contents of sensitive files (e.g., client.keys, ossec.conf, private keys) to the attacker.
This can lead to the theft of authentication keys, allowing the attacker to impersonate other agents or decrypt network traffic.
Protection
To protect against this vulnerability, administrators should immediately upgrade to Wazuh versions 4.10.4 or 4.14.5, which include the fix. If upgrading is not immediately possible, implement network-level restrictions to limit access to the enrollment port (1515/tcp) and the synchronization port (1514/tcp) to trusted IP addresses only. Additionally, monitor logs for suspicious enrollment requests containing `..` or other path traversal patterns. The official patch introduces proper input sanitization by rejecting group names that contain `..` or other dangerous characters.
Impact
Successful exploitation allows an attacker to read arbitrary files from the `/var/ossec/etc` directory on the Wazuh Manager. This includes:
– client.keys: Contains agent authentication keys, enabling agent impersonation.
– ossec.conf: The main configuration file, revealing internal settings and potentially other sensitive data.
– SSL certificates and private keys: Used for encrypted communications, allowing man-in-the-middle attacks or decryption of traffic.
– Other sensitive files like `internal_options.conf` and local_internal_options.conf.
This can lead to a complete compromise of the Wazuh deployment, loss of confidentiality, and potential lateral movement within the monitored environment.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: nvd.nist.gov
Extra Source Hub:
Undercode
