Description

Wazuh from 3.7.0 before 4.14.9 contains a server-side request forgery vulnerability in the Azure wodle get_graph_events() function that follows @odata.nextLink without host or HTTPS validation. Attackers who influence the nextLink value can redirect manager requests to attacker-controlled endpoints, capturing the reused Microsoft Graph bearer token and reaching internal services.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "3.7",
  "pubDate": "2026-11-06T15:17:08.060Z",
  "pubdate": "2026-11-06T15:17:08.060Z",
  "executiveSummary": "Wazuh versions 3.7.0 through 4.14.8 contain a Server-Side Request Forgery (SSRF) vulnerability within the Azure wodle, specifically affecting the get_graph_events() function.\nThe vulnerability arises from improper validation of the @odata.nextLink attribute during API pagination, enabling an attacker to force the Wazuh manager to perform unauthorized requests to arbitrary URIs.\nSuccessful exploitation allows attackers to redirect outbound requests to attacker-controlled endpoints, leading to the interception of sensitive Microsoft Graph bearer tokens or probing of internal network segments.\nThis SSRF exposure significantly elevates the risk of credential theft and lateral movement within an environment where the Wazuh manager is deployed.\nThe vulnerability does not require authentication from the attacker's perspective if they can influence the source data processed by the Azure wodle, effectively turning the manager into a proxy for malicious requests.\nOrganizations using the Wazuh Azure module are at risk of data exfiltration and credential compromise, necessitating immediate version verification and security hardening.",
  "technicalDetails": "The root cause of this vulnerability is the lack of host and protocol validation when the get_graph_events() function in the Wazuh Azure module processes the @odata.nextLink property returned by the Microsoft Graph API.\nThe Azure wodle is designed to retrieve event data by following pagination links provided in the 'nextLink' field of the API response. However, the implementation fails to enforce strict validation on the destination URL provided in this field, allowing an attacker to manipulate the value to point to an arbitrary host.\nBecause the function fails to verify that the 'nextLink' remains within the expected scope of the Microsoft Graph API endpoint, the Wazuh manager's outbound HTTP client is instructed to follow the attacker-supplied redirect or link.\nDuring the exploitation flow, the Wazuh manager reuses the existing Microsoft Graph bearer token for these subsequent requests. If the attacker forces the manager to request an attacker-controlled endpoint, the valid bearer token is sent as an Authorization header, allowing the attacker to capture the token.\nFurthermore, the vulnerability enables SSRF-based attacks against internal services. By providing an internal IP address or local service endpoint in the 'nextLink' value, an attacker can leverage the manager's network context to scan internal infrastructure, bypass perimeter security controls, and interact with internal APIs that are not exposed to the public internet.\nThe vulnerability exists in all Wazuh versions from 3.7.0 up to 4.14.9. Exploitation is facilitated when an attacker influences the data being fetched by the Azure wodle, effectively hijacking the legitimate request loop process.\nPost-exploitation impact includes the full compromise of the Azure service principal permissions associated with the bearer token, potential exfiltration of logs and configuration data, and the ability to conduct reconnaissance against the internal network segment hosting the Wazuh manager."
}