Description

Wazuh versions from 4.0.0 before 4.14.9 contain a sql injection vulnerability in WazuhDBBackend._substitute_params due to sequential regex placeholder cross-contamination. Authenticated users with agent:read on one agent can inject UNION SELECT via the q and search parameters to extract every agent's internal_key through a blind boolean oracle on total_affected_items.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-11-06T15:17:08.710Z",
  "pubdate": "2026-11-06T15:17:08.710Z",
  "executiveSummary": "Wazuh versions 4.0.0 through 4.14.8 are susceptible to a SQL injection vulnerability within the WazuhDBBackend._substitute_params function. The flaw arises from improper sanitization of user-supplied inputs, specifically within the 'q' and 'search' parameters.\nThis vulnerability allows an authenticated user possessing 'agent:read' privileges to perform unauthorized data extraction. By manipulating database queries, an attacker can bypass standard access controls to retrieve sensitive information, including the 'internal_key' of every managed agent.\nThe exploitation relies on a blind boolean oracle technique leveraging the 'total_affected_items' response to infer data bit by bit. Successful exploitation leads to a complete breach of agent confidentiality, potentially compromising the security integrity of the entire Wazuh environment.\nThe risk is classified as significant due to the ability to extract highly sensitive authentication keys, which could be leveraged to impersonate agents or facilitate further lateral movement. Remediation requires upgrading to version 4.14.9 or later, where the input handling logic has been corrected to prevent regex-based placeholder cross-contamination.",
  "technicalDetails": "The vulnerability resides within the WazuhDBBackend._substitute_params function, which is responsible for processing dynamic parameters before executing SQL queries against the Wazuh database. The root cause is identified as sequential regex placeholder cross-contamination, where the logic fails to properly isolate or escape parameters provided by the user.\nThe exploitation mechanism leverages the 'q' (query) and 'search' parameters typically utilized by the Wazuh API to filter agent information. Because these inputs are passed into the vulnerable function without adequate parameterization, an attacker can inject arbitrary SQL commands. Specifically, an attacker can append a 'UNION SELECT' statement to the existing query structure to point the execution towards sensitive tables containing agent credentials.\nThe attack flow follows a blind SQL injection pattern. Since the application may not directly return the results of the injected query, the attacker utilizes a boolean inference technique. By crafting queries that cause the 'total_affected_items' field in the API response to fluctuate based on the truthfulness of a condition (e.g., 'WHERE internal_key LIKE 'A%''), the attacker can extract the 'internal_key' character by character.\nThis process requires an authenticated session with 'agent:read' permissions. While this constraint limits the attack surface to authenticated users, it does not prevent an adversary from performing the attack if they have gained low-privileged access to the Wazuh API. The vulnerability effectively turns the read-only agent status into an information disclosure vector for the underlying database.\nThe vulnerable component is explicitly the backend logic managing database queries, and the issue exists across all versions from 4.0.0 up to 4.14.8. The payload behavior involves the manipulation of string placeholders that the backend incorrectly interprets as part of the SQL command structure rather than sanitized data. This leads to the modification of the original query intent, bypassing the intended authorization filters.\nPost-exploitation, the impact is severe. The 'internal_key' is a critical component for agent authentication; its theft allows an attacker to gain full control over the agent-server communication. An attacker possessing these keys could register unauthorized rogue agents, manipulate telemetry data, or potentially facilitate further exploits against the Wazuh manager instance."
}