关联漏洞
标题：
Wazuh 代码问题漏洞
(CVE-2025-24016)
描述：Wazuh是Wazuh开源的一个应用软件。用于收集，汇总，索引和分析安全数据，帮助组织检测入侵，威胁和行为异常。 Wazuh 4.4.0至4.9.1之前版本存在代码问题漏洞，该漏洞源于分布式API的不安全反序列化，允许攻击者实现远程代码执行。
描述
Detection for CVE-2025-24016 - Deserialization of Untrusted Data Vulnerability in the Wazuh software
介绍
# CVE-2025-24016
## How does this detection method work?
This Nuclei HTTP template checks a target URL (and its /app/login page) for the Wazuh web interface, extracts the wazuhVersion value with a regex, and confirms the page is accessible (200 status) and actually a Wazuh UI (via title and keyword match). If the extracted version sits between 4.4.0 and 4.9.0 (the vulnerable range for CVE-2025-24016), Nuclei reports a critical finding, signalling that unsafe deserialisation could allow remote code execution.
## How do I run this script?
1. Download Nuclei from [here](https://github.com/projectdiscovery/nuclei)
2. Copy the template to your local system
3. Run the following command: `nuclei -u https://yourHost.com -t template.yaml`
## References
- https://github.com/wazuh/wazuh/security/advisories/GHSA-hcrc-79hj-m3qh
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog
- https://www.cve.org/CVERecord?id=CVE-2025-24016
## Disclaimer
Use at your own risk, I will not be responsible for illegal activities you conduct on infrastructure you do not own or have permission to scan.
## Contact
Feel free to reach out to me on [Signal](https://signal.me/#eu/0Qd68U1ivXNdWCF4hf70UYFo7tB0w-GQqFpYcyV6-yr4exn2SclB6bFeP7wTAxQw).
文件快照
[4.0K] /data/pocs/5df95dc000bfa36fd5f3c1ebe6df575a8d6634a8
├── [1.6K] CVE-2025-24016.yaml
└── [1.2K] README.md
0 directories, 2 files
备注
1. 建议优先通过来源进行访问。
2. 如果因为来源失效或无法访问，请发送邮箱到 f.jinxu#gmail.com 索取本地快照（把 # 换成 @）。
3. 神龙已为您对POC代码进行快照，为了长期维护，请考虑为本地POC付费，感谢您的支持。