Listen to this Post
The vulnerability CVE-2025-54866 resides in the Wazuh agent for Windows, specifically within versions 4.3.0 to just before 4.13.0. During installation and operation, the agent creates a file named “authd.pass” at the path “C:\Program Files (x86)\ossec-agent\”. This file contains a crucial password used for authenticating the agent to the Wazuh manager. The security flaw is due to an improper configuration of the Windows Access Control List (ACL) on this file. By default, the ACL is not set correctly, missing restrictive permissions. Consequently, the “Authenticated Users” group on the Windows system is granted read access to this file. Any user or process that can log into the machine locally or via network, with standard or elevated privileges, falls under this group. This includes non-administrative users. Therefore, any authenticated entity can open and read the plaintext password stored within authd.pass. The exposed credential can then be leveraged by an attacker to impersonate the legitimate agent, potentially registering a malicious agent with the Wazuh server. This could lead to a compromise of the security monitoring infrastructure, allowing data exfiltration, false alert generation, or serving as a pivot point for further network attacks. The vulnerability is exploited locally, requiring an attacker to first gain authenticated access to the Windows host, which elevates the risk in shared or multi-user environments. The core issue is the absence of explicit deny entries or proper ownership settings in the file’s security descriptor, which was rectified in version 4.13.0 by applying a correct ACL that limits access to necessary system accounts only.
Platform: Wazuh
Version: 4.3.0-4.12.x
Vulnerability: Missing ACL exposure
Severity: Critical
Date: 2025-11-21
Prediction: Patched 4.13.0
What Undercode Say:
Analytics
!/bin/bash
Check for vulnerable file existence on mounted Windows drive
find /mnt/c -path “/ossec-agent/authd.pass” 2>/dev/null
Simulate permission check using icacls output parsing (run on Windows)
icacls “C:\Program Files (x86)\ossec-agent\authd.pass” | findstr “Authenticated Users”
Python snippet to detect weak permissions
import os, stat, subprocess
file_path = r”C:\Program Files (x86)\ossec-agent\authd.pass”
if os.path.exists(file_path):
try:
result = subprocess.check_output([‘icacls’, file_path], shell=True).decode()
if “Authenticated Users” in result and “(R)” in result:
print(“VULNERABLE: File is readable by Authenticated Users”)
except: pass
How Exploit:
1. Gain authenticated user access to Windows host.
2. Navigate to C:\Program Files (x86)\ossec-agent\.
- Read authd.pass file contents using command: type authd.pass
- Use captured password for agent impersonation or server authentication.
Protection from this CVE
Upgrade to version 4.13.0.
Manually restrict file ACLs.
Use dedicated agent accounts.
Impact:
Password disclosure.
Agent impersonation.
Privilege escalation.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: nvd.nist.gov
Extra Source Hub:
Undercode
