Description

Wazuh is an open-source security platform providing unified XDR and SIEM protection for endpoints and cloud workloads. The  ip-customblock  active response script contains a path traversal vulnerability that lets an attacker create or delete arbitrary files on the filesystem as root. The script builds a file path by concatenating the  srcip  field taken from alert JSON directly onto the fixed  /ipblock/  base directory, without validating that the value is a well-formed IP address. Because the extraction routine returns the raw string unchecked, an attacker who can trigger alert-matching log events with a crafted  srcip  containing  ../  sequences can escape the base directory. The block action opens the resulting path in append mode, creating an empty file at an arbitrary location, while the unblock action passes it to remove(), deleting an arbitrary file; since the active response daemon runs as root, this includes sensitive files such as system credentials and Wazuh configuration. Unlike the sibling scripts host-deny.c, default-firewall-drop.c, and firewalld-drop.c, which reject non-IP input via get_ip_version(), ip-customblock.c omits this validation. This issue is fixed in version 4.14.7.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.1",
  "pubDate": "2026-08-28T00:18:07.233Z",
  "pubdate": "2026-08-28T00:18:07.233Z",
  "executiveSummary": "The Wazuh security platform contains a critical path traversal vulnerability within the ip-customblock active response script, identified as an input validation failure. This flaw allows an attacker to perform unauthorized file system operations, including the creation and deletion of arbitrary files, by supplying crafted input during alert processing.\nThe vulnerability resides in the insufficient sanitization of the srcip field within alert JSON data, which is concatenated directly to a fixed file system path. Because the script executes with root-level privileges via the active response daemon, a successful exploitation results in total system compromise. An attacker capable of triggering alert-matching log events—specifically those involving manipulated IP addresses containing directory traversal sequences—can escape the intended sandbox directory.\nThe impact is severe, potentially allowing for the deletion of critical system configuration files or sensitive credentials, or the creation of empty files in protected system directories. This vulnerability affects Wazuh versions prior to 4.14.7. Mitigation requires immediate update to the patched version, as the active response daemon runs with elevated privileges, making any successful path escape an immediate escalation risk.",
  "technicalDetails": "The root cause of this vulnerability is improper neutralization of special elements used in an OS command or file path, specifically the lack of path sanitization in the ip-customblock.c script. Unlike other active response scripts within the Wazuh ecosystem—such as host-deny.c, default-firewall-drop.c, and firewalld-drop.c—which utilize the get_ip_version() function to validate input as a legitimate IP address, ip-customblock.c fails to perform this validation.\nThe exploitation flow begins when an attacker triggers an alert-matching log event. The Wazuh active response daemon extracts the srcip field from the JSON alert payload and concatenates it directly to the base directory path /ipblock/. Because the raw string is not checked for directory traversal sequences (e.g., ../), the resultant file path is determined by the attacker-controlled input. When the active response daemon performs a block or unblock action, it utilizes this tainted string as the target file path.\nSpecifically, the 'block' action triggers an open() operation in append mode using the malicious path, resulting in the creation of empty files at arbitrary locations. Conversely, the 'unblock' action passes the attacker-supplied string to the remove() system call. Because the active response daemon operates with root privileges, this allows the attacker to delete arbitrary files across the entire file system, including sensitive OS configuration files and authentication credentials.\nThe attack is highly effective because it leverages a trusted, high-privilege component of the Wazuh platform to perform destructive operations. The vulnerability is present in the ip-customblock.c component and affects all versions of Wazuh prior to 4.14.7. No specific authentication is required if an attacker can induce the generation of an alert containing the malicious srcip payload, effectively bypassing intended security controls via the logging infrastructure. Post-exploitation impact ranges from local denial-of-service, through the destruction of system configuration, to potential privilege escalation or persistence mechanisms by manipulating sensitive system files."
}