Critical Wazuh Vulnerability Lets Attackers Tamper with Alerts and Delete Security Evidence

Key Takeaways

• A critical NDJSON injection flaw (CVE-2024-XXXX) has been discovered in Wazuh Manager.
• The vulnerability allows unauthenticated attackers to tamper with security alerts, delete forensic evidence, and manipulate SIEM data.
• The flaw affects Wazuh Manager version 5.0.0-beta1 and carries a maximum CVSS score of 10.0.
• A fix is available in Wazuh version 5.0.0-beta3; immediate upgrade is strongly recommended.

A severe security vulnerability has been identified in Wazuh Manager, posing a significant risk to organizations that rely on the open-source security information and event management (SIEM) platform. The flaw, detailed as an NDJSON injection, could enable remote attackers to silently manipulate security alerts, erase crucial forensic evidence, and corrupt SIEM data across various environments.

Assigned a critical CVSS score of 10.0, the vulnerability underscores its profound impact and the ease with which it can be exploited by malicious actors. This makes immediate action imperative for affected users.

Technical Details of the Vulnerability

The core of the issue resides within Wazuh Manager version 5.0.0-beta1, specifically within the newly implemented inventory_sync subsystem. Researchers found that the system improperly handles the DataValue.index field, failing to sanitize untrusted input before forwarding it to the OpenSearch _bulk API.

The problematic code snippet illustrates this oversight:

m_bulkData.append(R"({"index":{"_index":")");
m_bulkData.append(index); // Untrusted input
m_bulkData.append(R"("}})");
m_bulkData.append("n");

While other fields, such as _id, are correctly escaped, the _index field is appended directly into the bulk request payload without any validation or filtering. This critical inconsistency allows a malicious or compromised agent to inject arbitrary OpenSearch bulk operations.

Exploitation and Impact

By crafting specially formatted newline characters and JSON fragments within the index field, an attacker can smuggle unauthorized actions into the index. For example, injecting payloads like:

wazuh-states-inventory"}}
{}
{"delete":{"_index":"wazuh-alerts-*","_id":"target-doc"}}
{"index":{"_index":"x

allows an attacker to insert commands such as delete, index, or update operations. These malicious operations are then executed with the privileges of the Wazuh indexer credentials, which often default to administrative access with full control over the system.

The attack vector is further amplified by insecure default configurations in wazuh-authd, which permit anonymous agent enrollment, meaning no prior authentication is required to initiate the attack. Once an agent is enrolled, an attacker can:

• Delete arbitrary documents from Wazuh indices, effectively wiping out alerts and logs.
• Modify vulnerability and inventory data associated with other agents.
• Inject malicious content into Kibana dashboards for persistence or to target security analysts.
• Perform cross-tenant data manipulation in shared environments, compromising data integrity.

Researchers successfully demonstrated an end-to-end exploit over standard Wazuh communication channels (TCP ports 1514 and 1515), confirming that injected delete operations could indeed remove targeted records from the backend. The vulnerability is primarily categorized under CWE-74 (Injection), alongside CWE-93 (CRLF Injection) and CWE-863 (Incorrect Authorization).

The root cause is the lack of input validation and improper neutralization of special characters in the DataValue.index field. Since Wazuh Manager utilizes high-privileged OpenSearch credentials from its keystore, this flaw essentially grants attackers administrative control over the indexed security data.

According to the GitHub advisory GHSA-ff9g-85jq-r3g3, the issue has been addressed and fixed in Wazuh version 5.0.0-beta3. Users are strongly advised to upgrade their installations immediately to mitigate this critical risk.

What You Should Do

• Upgrade Immediately: Update Wazuh Manager to version 5.0.0-beta3 or later to apply the official patch.
• Validate Input: Implement strict validation for all index names based on OpenSearch rules and escape all user-controlled input before constructing bulk requests.
• Enforce Least Privilege: Avoid using high-privilege roles, such as admin, for indexer operations. Instead, configure roles with the minimum necessary permissions.
• Disable Anonymous Enrollment: Disable anonymous agent enrollment in wazuh-authd and enforce secure authentication mechanisms for all agents.
• Review Logs: After patching, meticulously review historical logs for any signs of unauthorized index modifications or deleted records that might indicate prior exploitation.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.