Description

Wazuh from 4.3.0 before 4.14.9 contains a server-side request forgery vulnerability in the GitHub module (wm_github.c) that trusts unvalidated Link rel="next" pagination URLs. Attackers controlling the next-page URL can make the manager send requests with the GitHub API token to attacker hosts, exposing organization repositories and settings.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.9",
  "pubDate": "2026-11-06T15:17:08.217Z",
  "pubdate": "2026-11-06T15:17:08.217Z",
  "executiveSummary": "Wazuh versions 4.3.0 through 4.14.8 are susceptible to a server-side request forgery (SSRF) vulnerability within the GitHub integration module.\nThe vulnerability originates from the improper validation of the 'Link' HTTP header, specifically the 'rel=\"next\"' pagination attribute, which is utilized by the manager during GitHub API interactions.\nAn attacker capable of influencing the API responses from GitHub—or acting as a malicious proxy—can force the Wazuh manager to initiate unauthorized outbound requests.\nBy redirecting these requests to an attacker-controlled endpoint, the manager inadvertently exposes sensitive GitHub API tokens stored within the integration configuration.\nThe successful exploitation of this vulnerability leads to the potential exfiltration of organization-wide repository data and sensitive configuration settings.\nThis flaw represents a significant security risk, as it allows for the misuse of elevated integration privileges to facilitate information disclosure or further reconnaissance against the victim's infrastructure.\nThe vulnerability is limited to the server-side component, specifically the GitHub module responsible for API communication.",
  "technicalDetails": "The root cause of this vulnerability lies in the logic implemented within 'wm_github.c', specifically the pagination handling routine that processes the 'Link' header returned by the GitHub API.\nThe Wazuh manager's GitHub module parses the 'Link' header to facilitate traversing paginated result sets by following the 'rel=\"next\"' URL provided in the API response.\nCritically, the module fails to perform sufficient validation or sanitization on the URL contained within the 'rel=\"next\"' attribute before assigning it to the next request object.\nThe attack flow proceeds as follows: An attacker orchestrates a scenario where the GitHub API interaction is intercepted or where the attacker can influence the returned response (e.g., through a man-in-the-middle position or by poisoning the source of the API data).\nWhen the Wazuh manager parses the malicious 'Link' header containing an arbitrary destination URL, it assumes the URL is legitimate and belonging to the GitHub API infrastructure.\nThe manager subsequently initiates a GET request to this attacker-controlled URL, appending the configured GitHub API token as an authentication header in the request.\nBecause the Wazuh manager transmits the valid API token to the destination defined in the 'rel=\"next' attribute, the attacker effectively captures the token upon the receipt of the request at their listening host.\nThis bypasses internal access controls, as the request originates from the trusted Wazuh manager process. Once the attacker possesses the API token, they can impersonate the manager to query the GitHub API, leading to full access to organization repositories, webhooks, and environment settings.\nThe vulnerability resides entirely within the manager's backend processing logic, meaning that authentication or privilege requirements are limited to what is necessary to configure or trigger the GitHub integration.\nThe exposure is network-based, as the manager must be able to reach the attacker's endpoint, but the primary attack surface is the logic handling the API response itself, which is treated as implicitly trusted despite the dynamic nature of pagination links."
}